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ABSTRACT 


Risk  management  has  been  proven  to  be  a  valuable  tool  to  identify  and  mitigate  risks 
early  in  the  program  life-eyele.  Modernization  and  eommunieation  advanees  have 
reeently  ehanged  the  eommereial  eeonomy  from  national  to  global.  Companies  are 
starting  to  venture  into  new  partnerships  with  foreign  eompanies.  However,  there  has  also 
been  an  inerease  in  business  eorruption,  like  Fannie  Mae  and  Enron,  whieh  has  raised 
skeptieism  in  entering  new  partnerships.  Industry  is  addressing  this  faet  by  no  longer 
exelusively  depending  on  seienee  as  the  determining  faetor  in  risk  assessment  and 
starting  to  inelude  trust  as  a  faetor  in  risk  management.  Qualitative  measurements  are 
being  analyzed  in  attempted  to  address  these  uneertainties  by  ineorporating  “trusf’  into 
the  risk  management  proeess.  The  purpose  of  this  paper  was  to  determine  whether  it  was 
feasible  and  advantageous  to  ineorporate  “trust”  into  the  risk  management  proeess  for 
Department  of  Defense  (DOD)  aequisition.  The  premise  of  this  researeh  was  that  there 
were  hidden  risk  faetors  attributed  to  qualitative  measures  that  were  not  being  identified 
in  eurrent  DOD  risk  management  proeesses.  A  preliminary  eonelusion  of  this  thesis  is 
that  trust  is  a  valuable  faetor  in  the  risk  assessment  proeess  that  ean  help  identify 
qualitative  risk  elements. 
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EXECUTIVE  SUMMARY 


Risk  management  has  been  proven  to  be  a  valuable  tool  to  identify  and  mitigate  risks 
early  in  the  program  life-eyele.  Modernization  and  eommunieation  advanees  have 
reeently  ehanged  the  eommereial  eeonomy  from  national  to  global.  Companies  are 
starting  to  venture  into  new  partnerships  with  foreign  eompanies.  However,  there  has  also 
been  an  inerease  in  business  eorruption,  like  Fannie  Mae  and  Enron,  whieh  has  raised 
skeptieism  in  entering  new  partnerships.  Industry  is  addressing  this  faet  by  no  longer 
exelusively  depending  on  seienee  as  the  determining  faetor  in  risk  assessment  and 
starting  to  inelude  trust  as  a  faetor  in  risk  management.  Ronald  Regan  onee  said,  “Trust, 
but  verify”  when  he  was  entering  into  the  Intermediate-Range  Nuelear  Forees  Treaty  with 
his  new  foreign  partner  Russia  (Massie  2013). 

The  purpose  of  this  paper  was  to  determine  whether  it  was  feasible  and 
advantageous  to  ineorporate  “trust”  into  the  risk  management  proeess  for  Department  of 
Defense  (DOD)  aequisition.  The  premise  of  this  researeh  was  that  there  were  hidden  risk 
faetors  attributed  to  qualitative  measures  that  were  not  being  identified  in  eurrent  DOD 
risk  management  proeesses.  These  qualitative  measures  of  risk  eould  be  direetly  linked  to 
trust  elements.  This  researeh  paper  presents  an  argument  on  why  trust  should  be 
ineorporated  into  the  risk  management  proeess  for  DOD  aequisition  programs.  Various 
soeial,  behavior,  theologieal,  and  teehnieal  expert  definitions  on  the  term  trust  were  used 
to  deeompose  trust,  in  the  field  of  risk,  into  three  key  elements;  eonfidenee,  vulnerability, 
and  uneertainty.  The  three  trust  elements:  eonfidenee,  vulnerability  and  uneertainty,  were 
further  defined  and  eorrelated  with  eurrent  industry  program  risk  management  praetiees. 
Based  on  the  analysis  of  the  three  trust  elements,  trust  was  defined  for  the  purpose  and 
use  in  risk  management.  Trust  for  risk  management  was  defined  as  the  subjeetive 
probability  of  a  positive  outeome  from  an  agreement  between  two  or  more  parties  for  a 
domain  speeifie  task  based  on  the  eapability  and  goodwill  of  the  trustee  and  predietability 
of  a  positive  outeome  within  the  defined  teehnieal,  eost,  and  sehedule  boundaries. 

Modernization  of  oommunieation  paths  (i.e.,  e-mail  and  video  teleeonferenoing), 
and  quiek  teehnology  advaneement  have  opened  industry  to  new  partners  in  a  global 
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economy.  In  addition,  an  influx  of  business  corruption  has  left  people  and  companies 
skittish  about  openly  trusting  their  partners.  New  business  partners  lead  to  possible 
confidence,  vulnerability,  and  uncertainty  concerns.  Companies  have  to  weigh  these  trust 
elements  when  entering  new  partnerships  and  throughout  the  contract.  To  accentuate  the 
point  of  global  business  partnership  trust  based  risks,  this  thesis  analyzed  a  case  study  on 
the  Boeing  777  Dreamliner  program  which  had  an  unprecedented  scale  of  development 
outsourcing — 65  percent  of  the  development  work  was  outsourced  to  more  than  100 
suppliers  from  12  countries  (Exostar  2007;  Homg  and  Bozdogan  2007).  Prior  to  the  case 
study  analysis,  a  validation  of  the  case  study  was  conducted  against  Robert  Yin’s 
research  on  case  study  design  and  methods  (Yin  2009)  and  Gary  Langford’s  research  on 
engineering  methods  (Langford  2012).  The  case  study  was  concluded  as  valid  and 
appropriate  for  analysis  for  the  topic  of  this  research  on  trust  in  risk  management.  The 
analysis  of  the  case  study  determined  there  were  risk  items  associated  with  each  trust 
element  (confidence,  vulnerability,  and  uncertainty)  that  could  have  been  identified 
earlier  if  trust  had  been  incorporated  into  Boeing’s  risk  management  process. 

Research  was  also  conducted  on  the  feasibility  of  incorporating  the  trust  elements 
of  risk  into  the  risk  management  process  for  DOD  acquisition.  The  relationship  between 
trust  and  risk  was  defined  from  social  science  research  and  using  scientific  methods.  By 
examining  social  science  research  it  was  determined  that  to  capture  the  likelihood  and 
consequence  of  an  action  that  requires  dependence  on  other  individuals  to  take  action,  the 
element  of  trust  should  be  assessed.  Through  logic  and  psychometrics  studies  of  risk  and 
trust,  it  was  determined  that  risk  and  trust  were  inversely  related.  The  Dempster-Shafer 
theory  was  used  to  prove  that  trust  elements  could  be  added  as  long  as  there  is  no  major 
conflict  between  the  sources.  The  principle  of  indifference  (Keynes  1921)  supported  the 
theory  that  each  element  should  be  weighed  equally  since  we  have  no  idea  which  element 
is  more  plausible.  Alexander  McNeil’s  (2005)  research  on  the  axiom  of  coherence  was 
applied  to  conclude  that  risk  and  trust  elements  were  additive.  However,  the  process  is 
not  simple  mathematical  addition,  since  trust  and  risk  are  inversely  related.  Gary 
Langford’s  (2007)  method  for  managing  complexity  warranted  the  use  of  geometric 
relationships  to  combine  risk  and  trust  into  a  matrix  report. 


The  current  Risk  Management  Guide  for  DOD  Acquisition  (DOD  2006)  was 
studied  and  the  process  was  decomposed  to  determine  how  and  where  the  qualitative 
measures  (trust  factors)  of  risk  could  be  addressed.  The  most  practical  place  for  the  trust 
elements  of  risk  to  be  analyzed  was  during  the  analysis  of  the  quantitative  measurement 
of  risk.  A  detailed  step  by  step  example  of  how  to  take  a  risk  item  through  the  proposed 
risk  and  trust  management  process  for  DOD  acquisition  was  described.  Qualitative 
assessment  measurement  definitions  for  all  three  trust  elements;  confidence, 
vulnerability,  and  uncertainty  were  created.  Example  questions  were  also  provided  to 
assist  in  identifying  trust  risks.  The  risk  management  example  highlighted  how  a  risk 
item  that  was  assessed  quantitatively  as  a  low  risk  was  raised  to  a  medium  risk  when 
qualitative  measurements  (trust)  were  included  in  the  evaluation. 

In  conclusion,  this  research  paper  posits  that  the  incorporation  of  trust  into  the  risk 
management  process  for  DOD  acquisition  is  feasible  and  advantageous.  The  proposed 
risk  and  trust  management  process  will  provide  the  program  manager  more  insight  into 
the  root  cause  of  the  risk.  Clearer  insight  into  the  root  cause  will  aid  in  management  of 
risk  and  resource  allocation  for  mitigating  risk. 
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I.  INTRODUCTION 


A,  BACKGROUND 

Risk  management  has  been  proven  to  be  a  valuable  tool  to  identify  and  mitigate 
risks  early  in  the  program  life-cycle.  World-wide  modernization  and  communication 
advances  have  recently  changed  the  commercial  economy  from  national  to  global. 
Companies  are  starting  to  venture  into  new  partnerships  with  foreign  companies  to 
increase  their  market  share  (Marzec  2014).  However,  there  has  also  been  an  increase  in 
business  corruption,  like  Fannie  Mac  and  Enron,  which  has  raised  skepticism  in  entering 
new  partnerships.  Industry  is  addressing  this  fact  by  no  longer  exclusively  depending  on 
science  as  the  determining  factor  in  risk  assessment  and  starting  to  include  trust  as  a 
factor  in  risk  management.  Ronald  Regan  once  said,  “Trust,  but  verify”  when  he  was 
entering  into  the  Intermediate-Range  Nuclear  Forces  Treaty  with  his  new  foreign  partner 
Russia  (Massie  2013).  This  research  paper  explores  the  various  industries’  approaches  to 
incorporating  trust  into  the  risk  management  process  and  extracts  those  ideas  and 
processes  that  could  be  employed  into  the  Department  of  Defense  (DOD)  acquisition  risk 
management  process.  A  preliminary  conclusion  of  this  thesis  research  paper  is  that  trust 
is  a  valuable  factor  in  the  risk  assessment  process  that  can  help  identify  additional 
(hidden)  risks.  The  information  gathered  in  this  research  is  formulated  into  a  measurable 
weighted  metric  of  “trust”  that  may  be  incorporated  into  the  DOD  acquisition  risk 
management  process  in  an  attempt  to  highlight  program  qualitative  risks  that  were 
previously  overlooked. 

B,  PURPOSE 

The  purpose  of  this  paper  was  to  determine  whether  it  was  feasible  and 
advantageous  to  incorporate  “trust”  into  the  risk  management  process  for  Department  of 
Defense  (DOD)  acquisition.  The  premise  of  this  research  was  that  there  were  hidden  risk 
factors  attributed  to  qualitative  measures  that  were  not  being  identified  in  current  DOD 
risk  management  processes.  These  qualitative  measures  of  risk  could  be  directly  linked  to 
trust  elements.  The  ability  to  identify  areas  where  trust  can  lead  to  risk  will  enable 
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program  management  to  apply  the  resourees  and  oversight  required  to  mitigate  these 
epistemie  risks  to  minimize  eost  or  sehedule  loss. 

C.  RESEARCH  QUESTIONS 

There  is  an  enormous  amount  of  researeh  material  on  the  topie  of  trust  and  risk 
management.  In  order  to  focus  this  research  on  the  purpose  of  incorporating  trust  into  the 
risk  management  process  for  DOD  acquisition  the  following  research  questions  are 
posed. 

First,  define  trust.  Specifically,  in  what  ways  and  in  what  contexts  has  trust  been 
defined,  as  related  to  risk  assessment? 

Second,  determine  what  has  changed  in  society  that  has  made  “trust”  a  larger 
factor  in  the  risk  management  process.  Was  there  some  event  or  invention  that  has  caused 
companies  to  elevate  the  factor  of  trust? 

Third,  in  what  ways  has  trust  been  incorporated  in  commercial  sector  risk 
assessment  process?  Research  focuses  on  how  various  industries  are  identifying  trust 
issues  and  mitigating  them  as  part  of  the  risk  management  process. 

Fourth,  determine  the  relationship  between  trust  and  risk.  Can  the  element  of  trust 
and  risk  be  combined  into  a  single  solution  set? 

The  final  research  question  is  targeted  at  determining  whether  the  process  of 
incorporating  trust  into  the  DOD  acquisition  risk  management  process  is  feasible.  In 
addition,  are  there  benefits  in  identifying,  analyzing,  monitoring  and  managing 
qualitative  risks  that  would  be  highlighted  by  incorporating  trust? 

D,  BENEFIT  OF  STUDY 

This  research  can  be  used  to  improve  the  DOD  acquisition  risk  management 
process  through  the  incorporation  of  trust.  A  qualitative  and  quantitative  science  based 
methodology  will  be  used  to  determine  the  feasibility  of  combing  trust  and  risk.  The 
proposed  risk  and  trust  management  process  will  provide  the  program  manager  improved 
insight  into  the  root  cause  of  the  risk.  Clearer  insight  into  the  root  cause  of  risk  will 
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enhance  the  ability  of  program  management  to  mitigate  risk  and  prevent  cost  over  runs  or 
schedule  loss. 

E.  METHODOLOGY 

This  research  paper  examines  various  social  science  expert  definitions  of  trust, 
creates  a  decomposition  of  the  trust  definitions,  and  then  develops  a  standard  definition  of 
“trust”  for  risk  management.  This  research  paper  explores  various  reasons  why  industry 
has  turned  to  explore  trust  as  an  element  of  risk  in  its  business  practices.  Multiple 
experts’  views,  in  the  field  of  trust  and  risk  research,  were  investigated  to  determine  the 
feasibility  of  incorporating  trust  into  a  risk  management  process.  Additional  research  was 
conducted  to  explore  the  possible  methods  to  combine  trust  and  risk  into  the  risk 
management  process.  These  methods  were  translated  into  a  process  that  could  be 
employed  into  the  DOD  acquisition  risk  management  process.  The  information  gathered 
was  formulated  into  a  measurable  weighted  matrix  of  “trust”  that  may  be  incorporated 
into  the  DOD  acquisition  risk  management  process  in  an  attempt  to  highlight  program 
risks  that  were  previously  overlooked.  A  contemporary  case  study  of  the  Boeing  787 
Dreamliner  manufacturing  program  was  validated  then  investigated  to  demonstrate  the 
value  of  trust  in  the  risk  management  process. 

The  purpose,  methodology  and  research  questions  stated  above  guided  this 
research  paper.  The  following  paragraphs  will  lead  the  reader  through  the  research 
findings  and  conclusions.  The  next  chapter  will  lay  the  foundation  of  this  thesis  by 
defining  trust  and  reviewing  some  of  the  societal  changes  that  have  increased  industries 
interest  in  evaluating  trust  in  business. 
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II.  TRUST 


A.  DEFINED 

The  word,  “trust,”  originates  back  in  the  13th  century  from  the  Old  Norse  word, 
“traust,”  which  was  defined  as  “help,  confidence,  support’”  (Merriam- Webster  2014). 
Traust  is  cognate  with  the  German  word  “Trost,”  which  means  comfort  (Dictionary.com 
2014).  In  addition,  the  word  trust  was  also  akin  to  the  Old  English  word,  “treowe,”  which 
means,  “faithful”  (Merriam- Webster  2014).  The  origin  of  trust  points  directly  to  the 
interaction  between  two  or  more  parties.  The  synonyms  of  trust  are  confidence, 
expectation,  faith,  hope,  assurance,  certainty,  conviction,  credence,  dependence,  reliance, 
stock,  and  sureness.  Figure  1  presents  a  visual  depiction  of  the  word  trust  (Visual 
Thesaurus  2014). 


countenance 


let 


^  ,,  trustingness  © 

believe  trustfulness 


permit 

allow 


cartel 
corporate  trust 

hope 

combine  • 

desire  • 

faith  • 

confide  ^ 

commit 

intrust 

entrust 


reliance 


trUSl^'^  •  confidence 

rhtstrust 

distrust  ® 


loan 


rely 


swear 

bank 


lend 


belongings 

property  holding 


Figure  1.  Trust  Visual  Thesaurus  (from  Visual  Thesaurus  2014) 
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All  of  these  words  have  a  positive  eonnotation  and  base  their  premise  on  an 
interaetion  with  another  party.  To  verify  the  opposite  side  of  the  argument,  the  antonyms 
of  the  word  “trust”  were  then  analyzed.  The  most  eommon  antonyms  were  distrust  and 
mistrust,  whieh  were  both  defined  as  “to  have  no  trust  or  eonfidenee  in  (someone  or 
something)”  (Merriam- Webster  2014).  Other  eommon  antonyms  are  disbelief,  doubt, 
uneertainty,  and  suspeet.  As  before,  eaeh  of  these  terms  was  based  on  the  premise  that 
there  is  an  interaetion  between  two  or  more  parties. 

As  a  result,  one  ean  eonelude  that  trust  is  the  basie  element  to  any  eooperative 
relationship.  Therefore,  when  entering  a  business  eontraet,  it  is  very  important  that 
everyone  have  the  same  definition  of  trust.  This  is  mueh  more  eomplex  than  it  originally 
seems.  If  one  asks  20  strangers  to  define  trust....  after  the  initial  “huh”  statement,  one  will 
likely  get  20  different  answers.  This  simple  question  is  so  eomplieated  beeause  there  are 
several  variations  of  trust.  Trust  has  been  around  for  eenturies  and  has  evolved  based  on 
people’s  values  and  personal  experienees.  The  definition  of  trust  ean  also  ehange  based 
on  a  person’s  point  of  view:  eeonomie,  behavioral,  soeial,  or  physiologieal.  Eaeh 
variation  has  a  different  eonnotation  and  is  used  for  different  purposes.  Table  1  lists  some 
of  the  various  definitions  of  trust  as  defined  by  soeial  seienee  experts  from  their  field’s 
point  of  views. 
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Table  1.  Various  Trust  Definitions 


Theory 

Trust  Definition 

Author 

Economies 

“Decisions  about  trust  are  similar  to  other  forms  of 
risky  choice;  individuals  are  presumed  to  be  motivated 
to  make  rational,  efficient  choices  (i.e.,  to  maximize 
expected  gains  or  minimize  expected  losses  from  their 
transactions).” 

Oliver  E. 

Williamson  (1985) 

Psychology 

“Trusting  behavior  occurs  when  an  individual 
perceives  an  ambiguous  path,  the  result  of  which 
could  be  good  or  bad,  and  the  occurrence  of  the  good 
or  bad  result  is  contingent  on  the  actions  of  another 
person” 

Morton  Deutsch 
(1962) 

Subjective 

“[TJrust  is  the  mutual  confidence  that  one’s 
vulnerability  will  not  be  exploited  in  an  exchange” 

Barney  and 
Hansen  (1994) 

Sociology 

“Trust  is  a  bet  on  the  future  contingent  actions  of 
others” 

Piotr  Sztompka 
(1999) 

Information 

“Trust  is  that  which  is  essential  to  a  communication 
channel  but  cannot  be  transferred  from  a  source  to  a 
destination  using  that  channel.” 

Ed  Gerck(1998) 

Common 

Definition 

“Trust  is  a  belief  that  someone  will  do  some  function 
when  asked  to  do  it” 

Merriam- Webster 
(2014) 

Social 

Science 

“Trust  is  an  expectancy  of  positive  (or  nonnegative) 
outcomes  that  one  can  receive  based  on  the  expected 
action  of  another  party  in  an  interaction  characterized 
by  uncertainty’  ’ 

Bhattacharya, 
Devinney,  and 
Pillutla(1998) 

Risk 

Related 

“[TJrust  as  a  state  involving  confident  positive 
expectations  about  another’s  motives  with  respect  to 
oneself  in  situations  entailing  risk’  ’ 

Boon  and  Holmes 
(1991) 

Behavioral 

“[TJrust ...  is  a  particular  level  of  the  subjective 
probability  with  which  an  agent  assesses  that  another 
agent  or  group  of  agents  will  perform  a  particular 
action’  ’ 

Gambetta  (1988) 
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This  research  is  only  going  to  focus  on  the  risk  management  aspect  of  trust.  More 
precisely,  how  trust  can  play  a  part  in  a  program’s  risk  management  process?  By 
analyzing  the  trust  definitions  from  a  risk  perspective  a  few  common  elements  can  be 
pulled  out.  The  three  common  elements  of  trust  with  respect  to  risk  are  confidence, 
vulnerability,  and  uncertainty.  These  three  elements  will  be  examined  further  to  complete 
the  definition  of  trust  in  the  area  of  risk  management. 

1,  Confidence 

The  first  element  of  trust  in  risk  management  is  confidence.  Confidence  in 
business  can  be  defined  as  the  belief  that  the  partner  has  the  tools  and  capability  to 
perform  the  task  that  is  required.  Contractors  may  have  the  best  intentions  and  really  try 
to  perform  a  task;  however,  sometimes  the  technology  is  above  their  capability.  For 
example,  this  author  worked  on  a  missile  detection  program  in  which  the  awarded 
contractor  was  known  for  producing  missiles  and  a  missile  warning  protection  system 
that  both  operated  in  the  one  frequency  spectrum  band.  During  award  selection,  the 
consensus,  which  should  have  been  deemed  invalid,  was  that  a  contractor  that  built 
missiles  and  threat  detectors  in  one  frequency  spectrum  band  should  also  be  able  to 
develop  a  missile  detection  system  that  operated  in  the  different  frequency  spectrum 
band.  In  the  end,  the  contractor  was  unable  to  deliver  a  missile  detection  system  in  the 
different  frequency  band.  This  cost  the  tax  payers  millions  of  dollars  and  the  war-fighter 
a  three-year  delay  in  capability.  A  contributing  factor  to  the  failure  of  the  program  was 
the  contractor’s  lack  expertise  in  the  different  frequency  spectrum.  The  government 
bestowed  too  much  confidence  in  the  contractor’s  experience  in  the  original  spectrum 
when  evaluating  its  capability  to  develop  a  system  in  a  different  spectrum.  This  is  but  one 
example  of  how  adding  trust  into  the  risk  management  process  could  lead  to  better 
choices.  Most  people  would  not  trust  a  stock  broker  to  fix  their  car.  Nor  would  most 
people  trust  a  mechanic  to  invest  their  money  in  the  stock  market.  Confidence  as  related 
to  trust  should  be  domain  specific  to  the  task  being  assigned  to  performed. 
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Another  example  of  a  poor  selection  of  a  prime  contractor  based  on  blind 
confidence  is  the  Affordable  Healthcare  website  release.  As  reported  by  the  Washington 
Post,  “The  lead  contractor  on  the  dysfunctional  Website  for  the  Affordable  Care  Act  is 
filled  with  executives  from  a  company  that  mishandled  at  least  20  other  government  IT 
projects”  (Markon  and  Crites  2013).  So  why  was  this  company  selected  if  it  had  been 
linked  to  previous  troubled  programs?  The  reason  was  simple:  based  on  past  performance 
(1970s-1990s),  the  company  had  built  a  reputation  as  the  best  company  for  Health  and 
Human  Services  IT  programs.  As  a  result,  CGI  Federal  was  placed  on  a  prescreening  list 
that  put  them  as  front  runners  for  any  urgent  projects.  However,  due  to  senior  executive 
and  a  high  employee  turnover  rate  at  the  end  of  the  1990s,  the  company  was  not  the  same 
company  and  started  struggling  with  the  completing  programs  on  time  and  within  budget. 
“They  did  not  provide  us  one  working  piece  of  software  after  almost  six  years,”  recalled 
Ed  Buelow  Jr.,  the  Mississippi  state’s  former  revenue  commissioner  (Markon  and  Crites 
2013).  Confidence  in  a  company  to  perform  a  task  should  not  only  be  based  relative  past 
performance  but  also  include  a  real-time  snapshot  of  a  partner’s  current  program(s) 
performance  and  domain  specific  technical  capability.  Chapter  IV  will  discuss  how  to 
assess  confidence  levels. 

2,  Vulnerability 

The  second  element  of  trust  in  risk  management  is  vulnerability.  The  vulnerability 
side  of  trust  can  be  taken  from  Chiles  and  McMackin  (1996,  85)  where  they  define  trust 
as  “the  expectation  that  an  exchange  partner  will  not  engage  in  opportunistic  behavior, 
even  in  the  face  of  countervailing  short-term  incentives  and  uncertainty  about  long-term 
benefits.”  In  other  words,  in  business  a  company  must  determine  who  they  can  trust  to 
follow  through  on  an  agreement.  As  Francis  Fukuyama  (1995,  26)  points  out,  “the  most 
effective  organizations  are  based  on  communities  of  shared  ethical  values.”  Industries, 
such  as  networking  systems,  e-commerce,  and  financial  banking,  have  taken  this  notion 
and  moved  to  minimize  vulnerability  with  new  global  partners  companies  by  looking  for 
companies  that  share  mission  statements  and/or  ethical  values.  Companies,  within  these 
industries,  are  evaluating  potential  partner  company’s  values  by  assessing  with  whom 

they  already  have  business  partnerships.  For  example,  Subaru  is  well  known  for  valuing 
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safety.  Therefore,  if  Subaru  is  looking  for  a  business  partnership  with  a  windshield 
eompany,  Subaru  will  look  for  a  windshield  eompany  that  works  with  other  eompanies 
known  for  safety,  such  as  Volvo.  To  assess  a  business  partner’s  ethical  values  and 
integrity,  companies  are  researching  common  associations  of  potential  partners,  such  as 
the  charities  they  support,  community  involvement,  and  professional  organizations  with 
which  they  are  associated,  such  as  International  Council  on  Systems  Engineering 
(INCOSE).  Castelfranchi  and  Ealcone  (2000)  refer  to  this  notion  as  relational  capital  on 
which  trust  is  built. 

Another  side  of  vulnerability  is  to  assess  the  trustee’s  intention  and  willingness  to 
act  in  the  interests  of  the  trustor,  otherwise  known  as  goodwill  (Das  and  Teng  2001). 
Companies  must  determine  the  level  to  which  their  partner  is  committed  to  their 
relationship.  Piotr  Sztompka  (1999)  brings  up  a  similar  argument  by  asserting  that  if  the 
companies  are  co-dependent  on  each  other  to  sustain  and/or  build  up  their  company’s 
infrastructure  then  risk  is  reduced.  In  addition,  if  both  parties  are  looking  to  promote  a 
long  term  relationship  then  vulnerability  goes  down  and  risk  is  reduced.  Most  business 
relationships  will  not  have  equal  dependence  on  one  another,  but  the  trustee  must  take 
this  measurement  into  account  as  a  risk  to  the  program.  If  the  trusted  has  little  mutual 
benefit  in  the  success  of  a  program’s  success,  then  the  trusted  company  could  walk  away 
when  provided  a  better  opportunity,  or  just  reprioritize  its  resources,  which  could  cause 
delays  to  its  delivery  of  product  to  the  trustee  (i.e.,  other  business  partner).  Karahannas 
and  Jones  (1999,  347)  note  that  trust  is  “closely  related  to  risk,  since  without  vulnerability 
there  is  no  need  for  trust.”  Therefore,  a  company  must  determine  their  level  of 
vulnerability  to  determine  the  level  of  trust  the  company  is  betrothing  to  the  trustor  (i.e., 
business  partner).  This  level  of  trust  will  ultimately  indicate  the  companies  risk  level. 
Chapter  IV  will  discuss  how  to  determine  a  company’s  vulnerability  level. 

3.  Uncertainty 

The  third  element  of  trust  in  risk  management  is  uncertainty.  The  term  “risk”  is 
generally  used  to  describe  adverse  events  with  a  known  probability  (Adams  1995). 
Uncertainty  stems  from  the  lack  of  knowledge  and  therefore  has  an  unknown  probability. 
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also  known  as  epistemic  uncertainty  (Amendola  2002).  This  lack  of  knowledge  could 
stem  from  a  new  technology  being  developed  or  a  new  manufacturing  process  that  a 
company  is  employing  for  the  first  time.  International  organizations  such  as  INCOSE, 
International  Organization  for  Standardization  (ISO),  DOD,  and  Software  Engineering 
Institute  (SEI)  have  tried  to  minimize  this  uncertainty  by  setting  up  standard  processes  for 
companies  to  follow.  As  a  result,  companies  will  often  require  that  their  contractors  to 
have  certain  process  certifications,  such  as  ISO  9000  or  Capability  Maturity  Model 
Integration  (CMMI),  and  required  that  the  contractor  follow/maintain  these  processes  for 
the  duration  of  the  program  under  contract.  However,  a  company  may  have  a  certification 
but  never  employed  this  certified  process  in  the  domain  of  the  current  task.  Eor  example, 
a  company  can  be  CMMI  level  5  for  developing  missiles,  but  never  have  employed  the 
process  for  sensor  development.  Therefore,  even  with  these  controls  in  place  there  is 
always  uncertainty.  Companies  do  not  have  the  time  or  ability  to  work  out  probability 
expectations  for  every  possible  outcome,  nor  can  a  company  brainstorm  every  possible 
problem  that  may  occur.  In  order  to  facilitate  the  process  of  calculating  the  probability  of 
the  unknown,  companies  typically  set  aside  additional  funding  and  resources,  called 
“management  reserve,”  to  deal  with  a  level  of  uncertainty.  However,  the  amount  of 
“management  reserve”  set  aside  for  a  program  is  an  estimate  and  generally  based  on  a 
high  level  of  confidence  that  things  will  go  according  to  plan.  The  above  sediment  is 
supported  by  Euhmann  (1979),  “In  situations  of  uncertainty,  trust  allows  short-cutting 
probability  calculations  and  thus  reduces  complexity.”  The  problem  with  this  approach  is 
that  the  management  reserve  account  is  typically  managed  only  by  the  program  manager 
allowing  the  funding  and  resources  set  aside  for  uncertainty  to  be  used  for  other  tasking. 
Therefore,  risk  is  elevated  by  depleting  funding  and  resources  intended  for  uncertainty. 
Chapter  IV  will  discuss  how  to  assess  a  program’s  uncertainty  level. 

4,  Trust  Defined  in  Risk  Management 

Based  on  the  analysis  of  the  definitions  of  trust  from  the  various  social  science 
fields  and  the  derived  trust  elements,  a  definition  for  trust  for  the  field  of  risk 
management  can  be  affirmed.  This  research  defines  trust  for  the  purpose  of  program  risk 

management  as  the  subjective  probability  of  a  positive  outcome  from  an  agreement 
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between  two  or  more  parties  for  a  domain  specific  task  based  on  the  capability  and 
goodwill  of  the  trustee  and  predictability  of  a  positive  outcome  within  the  defined 
technical,  cost  and  schedule  boundaries. 

B,  HOW  HAS  SOCIETY  CHANGED  TO  ELEVATE  THE  IMPORTANCE  OF 

TRUST? 

Niklas  Luhmann  (1979)  stated  that  trust  gains  in  importance  as  society  becomes 
more  modem.  The  combination  of  new  technology,  system  complexity  and 
modernization  raises  the  likelihood  of  uncertainty  and  risk.  Two  distinctive  points  can  be 
pulled  from  Luhamm’s  comment:  society  modernization  and  technology.  World-wide 
modernization  and  communication  advances  have  recently  changed  the  commercial 
economy  from  national  to  global.  Communication  advancements  over  the  past  three 
decades,  such  as  video  teleconferencing  and  e-mail,  have  aided  this  global  partnership  to 
develop  business  partners  internationally.  Businesses  are  no  longer  handcuffed  to 
partnering  with  local  companies  and  are  branching  out  to  partner  with  foreign  companies 
for  three  main  reasons:  cost,  component  specialist  /  expertise,  and  proximity  /  market 
share  (Marzec  2014).  Companies  are  looking  to  reduce  their  overhead  costs,  facility 
labor,  utilities  and  real  estate  taxes,  and  have  found  costs  cheaper  overseas  (Hamlett 
2014).  As  products  get  more  complex,  they  require  multiple  specialized  components  to  be 
manufactured.  The  cost  of  setting  up  a  manufacturing  product  line  for  every  component 
in  a  complex  product  (e.g.,  manufacturing  a  computer,  airplane,  or  car)  would  be  too 
burdensome  for  one  company.  Outsourcing  production  to  a  second  company  that  has 
expertise  in  producing  the  material  can  decrease  production  time  (Hamlett  2014). 
Another  advantage  is  if  the  product  line  changes  or  a  repair  to  equipment  is  required,  the 
responsibility  for  the  cost  associated  with  this  process  falls  on  the  supplier  (Hamlett 
2014).  Therefore,  companies  look  to  outside  manufacturers  to  supply  their  specialty 
components.  Proximity  reflects  the  global  growth  of  the  market  place.  Companies  are 
always  looking  to  increase  their  market  share,  and  modernization  of  other  countries  has 
produced  new  foreign  customers.  As  a  result,  companies  are  outsourcing  some  of  their 
manufacturing  to  foreign  countries  in  hopes  of  getting  their  business.  For  example, 
Boeing’s  Dreamliner  program  had  an  unprecedented  scale  of  development  outsourcing — 
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65  percent  of  the  development  work  was  outsourced  to  more  than  100  suppliers  from  12 
countries  (Exostar  2007;  Horng  and  Bozdogan  2007).  This  program  will  be  analyzed  as  a 
case  study  in  Chapter  V.  While  these  new  partnerships  may  open  companies  to  profits, 
they  also  open  the  company  to  the  trust  elements  or  risk  in  confidence,  vulnerability,  and 
uncertainty.  As  part  of  this  global  business  partnership,  companies  are  relying  on  both 
quantitative  risk  analysis,  but  also  qualitative  risk  analysis  (also  known  as  trust  analysis) 
to  determine  a  company’s  trustworthiness.  For  example,  the  banking  industry  is  updating 
their  small  business  lending  models  to  use  qualitative  information  along  with  financial 
information  to  forecast  small  company’s  creditworthiness  (Grunet  2005).  Qualitative  data 
that  companies  may  gather  include  information  about  the  reputation  of  the  company  by 
asking  questions  such  as:  how  does  the  company  treat  its  own  employees  (What  is  the 
turnover  rate?);  how  long  the  company  has  been  in  business?,  what  are  the  employee  skill 
sets  that  the  company  hires?  and,  who  were  the  company’s  past  business  relationships? 
Companies  are  also  looking  into  potential  partners’  past  performance  to  determine 
qualitative  risk  using  questions  such  as:  does  the  company  meet  their  obligations?  and 
has  the  company  met  deadlines  and  provided  their  product  on  time?  Favorable  responses 
to  these  qualitative  risks  are  the  building  blocks  of  trust  in  a  business  partnership  and 
should  be  assessed  during  contract  initiation  and  throughout  the  life  cycle  of  a  program. 

The  last  main  contributor  to  companies  adding  qualitative  risk  assessment  into 
their  program  management  decisions  is  the  influx  of  business  corruption.  A  man’s  word 
was  his  honor,  and  when  he  shook  hands  on  a  deal,  it  was  followed  through.  But  now 
litigation  and  profit  are  the  dominant  players.  WorldCom,  EnRon,  and  FreddieMac  are 
just  a  few  examples  of  how  businesses  have  strayed  from  the  path  of  trust  as  a  priority  to 
the  path  of  profit  as  a  priority,  often  compromising  trust  elements.  As  a  result,  companies 
look  to  protect  themselves  with  well-crafted  contracts  by  teams  of  lawyers,  which 
basically  state,  “We  don’t  trust  you.”  This  leads  to  the  last  point,  most  do  not  like  to 
confront  one  another  and  say  they  do  not  trust  each  other.  Imagine  talking  to  a  stranger  in 
the  airport  line  and  after  five  minutes  of  meeting  that  person  you  tell  him  that  you  do  not 
trust  him  but  would  like  to  be  friends.  That  person  will  immediately  be  put  on  the 
defensive,  and  you  are  not  likely  to  develop  a  friendship.  The  same  holds  true  in 
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business;  starting  off  a  business  relationship  by  openly  stating  distrust  is  not  a  good  way 
to  build  eohesion  in  the  relationship.  As  a  result,  some  companies  tend  to  ignore  the 
qualitative  risks  to  avoid  confrontation  and  lean  toward  assumed  trust. 

In  this  chapter,  a  definition  of  trust  was  derived  based  on  the  analysis  of  the 
definitions  of  trust  from  the  various  social  science  fields.  The  definition  of  trust  was 
decomposed  into  three  key  elements:  confidence,  vulnerability  and  uncertainty.  Each 
element  of  trust  was  defined  to  establish  a  standard  definition  to  support  this  research 
paper.  In  addition,  this  chapter  highlighted  some  of  the  factors  and  past  historical  events 
that  have  caused  trust  to  become  more  influential  to  companies  when  making  business 
decisions.  The  following  chapter  will  summarize  the  Risk  Management  Guide  for  DOD 
Acquisition  to  construct  the  foundation  for  incorporating  trust  into  the  established  risk 
management  process. 
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III.  DOD  RISK  MANAGEMENT  PROCESS 


A,  DEFINED 

Risk  management  is  the  overarching  process  that  encompasses  risk  identification, 
analysis,  mitigation  planning,  mitigation  plan  implementation,  and  tracking  (DOD  2006). 
The  purpose  of  risk  management  is  to  identify  cost,  schedule,  and  technical  risks  that  may 
occur  in  the  future  of  a  program  so  that  each  risk  item  can  be  monitored  and/or 
controlled.  The  Risk  Management  Guide  for  DOD  Acquisition  breaks  risk  into  three 
components:  1)  it  must  be  a  future  root  cause  that  can  be  overcome  or  avoided,  2)  the  risk 
has  a  likelihood  of  occurring  if  not  managed,  and  3)  there  is  a  consequence  of  cost, 
schedule  and/or  technical  performance  if  the  risk  realized.  By  addressing  program  risks 
early  on,  the  potential  for  program  cost  and  schedule  overruns  may  be  mitigated.  In 
addition,  risk  management  may  also  forecast  technical  risks  that  could  be  mitigated  or 
overcome  by  applying  additional  resources  earlier  than  originally  planned. 

The  first  step  in  the  risk  management  process  is  to  identify  the  risk  items  of  a 
program.  In  order  to  identify  risk,  one  must  know  what  is  the  definition  of  risk,  general 
practices  on  how  risks  can  be  identified,  and  who  should  identify  risk.  The  Risk 
Management  Guide  for  DOD  Acquisition  summarizes  risk  as  the  root  cause  that  can 
prevent  a  program  from  achieving  performance  goals  and  objectives  within  defined 
performance  constraints,  cost,  and  schedule  over  the  life  cycle  of  the  program.  Best 
practice  to  identifying  risk  is  to  decompose  the  program  into  the  work  breakdown 
structure  (WBS)  elements  and  allow  the  system  matter  experts  to  identify  risk  for  each 
WBS  based  on  prior  experience,  according  to  the  Risk  Management  Guide  for  DOD 
Acquisition  (2006).  Risk  identification  should  not  only  occur  at  the  beginning  of  a 
program.  Risk  should  continually  be  identified  in  all  facets  of  the  program  to  include  the 
ability  to  assess  technical  performance,  schedule,  resource  availability,  program  cost, 
manufacturing  process  and  contractor  earned  value  management  (EVM)  data/trends. 
Since  risk  affects  all  areas  of  the  program,  risk  identification  should  be  the  job  of  the 
entire  program  team;  this  includes  the  test  manager,  financial  manager,  contracting 
officer,  logistician,  and  every  other  team  member,  not  just  the  program  manager  or 
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systems  engineer.  In  addition,  sinee  the  eontraetor’s  ability  to  develop  and  manufaeture 
the  system  affeets  program  risks;  the  eontraetor  should  also  be  eonsidered  a  valuable 
partner  in  risk  plaiming. 

The  identified  risk  must  then  be  analyzed  to  determine  how  big  the  risk  is.  The 
Risk  Management  Guide  for  DOD  Aequisition  uses  a  Risk  Reporting  Matrix,  Figure  2,  to 
assess  the  level  of  risk  for  eaeh  risk  item.  The  risk  is  reported  as  low  (green),  moderate 
(yellow),  or  high  (red)  based  on  the  assigned  values  of  likelihood  and  eonsequenee  of 
eaeh  risk  element. 
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Figure  2.  Risk  Reporting  Matrix  (from  DOD  2006) 

Each  risk  item  is  assigned  a  value  for  the  likelihood  of  occurrence.  The  likelihood 
is  the  probability  that  an  action  could  occur  based  on  past  experience  and  current  data.  A 
typical  likelihood  definition  is  depicted  in  Figure  3  (DOD  2006).  An  explanation  of  how 
to  read  and  use  the  likelihood  criteria  figure  is  described  in  the  following  paragraphs. 
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Level 

Likelihood 

Probability  of  Occurrence 

1 

Not  Likely 

-10% 

2 

Low  Likelihood 

-30% 

3 

Likely 

-50% 

4 

Highly  Likely 

-70% 

5 

Near  Certainty 

-90% 

Figure  3.  Levels  of  Likelihood  Criteria  (from  DOD  2006) 


Each  risk  element  is  also  assigned  a  consequence  value.  Consequence  is  an 
assessment  of  how  the  risk  element  will  affect  technical  performance,  schedule  or  cost  if 
realized.  A  typical  DOD  Risk  Management  consequence  definition  table  is  shown  in 
Figure  4  (DOD  2006).  An  explanation  of  how  to  read  and  use  the  consequence  criteria 
figure  is  described  in  the  following  paragraphs. 
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Level 

Technieal  Performance 

Schedule 

Cost 

1 

Minimal  or  no  consequence  to  technical 
performance 

Minimal  or  no 
impact 

Minimal  or  no 
impact 

2 

Minor  reduction  in  technical  performance 
or  supportability,  can  be  tolerated  with 
little  or  no  impact  on  program 

Able  to  meet  key 
dates. 

Slip  <  ^month(s) 

Budget  increase 
or  unit 

production  cost 
increases. 

<  **  ( 1 %  of 
Budget) 

3 

Moderate  reduction  in  technical 
performance  or  supportability  with  limited 
impact  on  program  objectives 

Minor  schedule  slip. 
Able  to  meet  key 
milestones  with  no 
schedule  float. 

Slip  <  ^month(s) 

Budget  increase 
or  unit 

production  cost 
increase 

Sub-system  slip  >  * 
month(s)  plus 
available  float. 

<  **  (5%  of 
Budget) 

Budget  increase 

4 

Significant  degradation  in  technical 
performance  or  major  shortfall  in 
supportability;  may  jeopardize  program 
success 

Program  critical  path 
affected. 

Slip  <  ^months 

or  unit 

production  cost 
increase 

<^(10%  of 
Budget) 

5 

Severe  degradation  in  technical 
performance;  Cannot  meet  KPP  or  key 
technical/supportability  threshold;  will 
jeopardize  program  success 

Cannot  meet  key 
program  milestones. 

Slip  >  ^months 

Exceeds  APB 
threshold 

>^(10%  of 
Budget) 

Figure  4.  Levels  and  Types  of  Consequence  Criteria  (from  DOD  2006) 
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The  risk  item  is  then  plotted  on  the  5X5  Risk  Reporting  Matrix  (Figure  1)  based 
on  its  likelihood  and  eonsequence  values  and  the  risk  level  is  reported  as  low  (green), 
moderate  (yellow),  or  high  (red). 

After  the  risk  item  has  been  assigned  a  risk  value,  the  program  risk  team  will 
attempt  to  identify  mitigation  steps  that  could  potentially  lower  the  likelihood  or 
consequence  value.  For  example,  if  the  program  is  worried  about  a  part  not  fitting  in  the 
aircraft,  the  program  could  hire  someone  to  build  a  non-working  prototype  to  conduct  a 
fit  check  prior  to  the  final  system  build. 

Once  the  mitigation  steps  are  identified,  the  Integrated  Program  Team  (IPT)  can 
start  making  decisions  on  the  specifics  of  what  needs  to  be  done,  when  in  the  schedule  it 
can  be  accomplished,  who  is  the  responsible  party,  and  is  whether  there  is  enough 
funding  to  implement  the  risk  mitigation  plan. 

Throughout  the  life  cycle  of  the  program,  the  program  manager  will  track  the 
progress  of  the  risk  items.  In  addition,  the  program  will  hold  periodic  Program  Risk 
Management  Boards  to  address  new  risk  items  and  report  on  the  status  of  the  current  risk 
items.  Figure  5  shows  the  basic  DOD  Risk  Management  Process.  The  risk  management 
process  is  iterative  should  continually  be  managed  throughout  the  acquisition  life  cycle. 


39 


Risk 

Identification 


% 


•t 


Risk 


Risk 


Tracking 


Analysis 


% 


Risk 

Mitigation 

Planning 


Risk 

Mitigation 

Plan  Implementation 


Figure  5.  DOD  Risk  Program  Management  Process  (from  DOD  2006) 

This  chapter  summarized  the  current  DOD  risk  management  process  as  outlined 
by  the  Risk  Management  Guide  for  DOD  Acquisition.  The  process  of  risk  identification, 
analysis,  mitigation  planning,  mitigation  plan  implementation,  and  tracking  was 
described.  Risk  was  defined  by  three  components:  1)  it  must  be  a  future  root  cause  that 
can  be  overcome  or  avoided,  2)  the  risk  has  a  likelihood  of  occurring  if  not  managed,  and 
3)  there  is  a  consequence  of  cost,  schedule  and/or  technical  performance  if  the  risk 
realized.  The  current  process  of  assessing  risk  on  the  5X5  Risk  Reporting  Matrix  based 
on  the  definitions  of  likelihood  and  consequence  was  reviewed.  The  following  chapter 
will  evaluate  the  feasibility  and  value  of  incorporating  trust,  as  defined  in  Chapter  II,  into 
the  DOD  risk  management  process. 
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IV.  ALIGNMENT  OF  TRUST  INTO  THE  DOD  RISK 
MANAGEMENT  PROCESS 


A,  THE  RELATIONSHIP  BETWEEN  TRUST  AND  RISK 

The  relationship  between  trust  and  risk  must  be  defined  in  order  to  implement 
trust  into  the  risk  management  proeess.  Castelfranchi  and  Falcone  (2000,  4)  summarize 
the  difference  between  risk  and  trust  by  stating,  “risk  is  just  about  the  possible  outcome 
of  a  choice,  about  an  event  and  a  result;  trust  is  about  a  person  or  organization:  it  mainly 
consists  of  beliefs,  evaluations,  and  expectations  about  the  other  actor,  his  capabilities, 
willingness,  and  general  motivations.”  So,  if  risk  and  trust  are  not  the  same,  how  are  they 
related? 

To  determine  the  relationship  between  risk  and  trust  one  must  answer,  “Can  risk 
exist  without  trust?”  The  answer  is  “yes.”  The  following  simple  example  will  rationalize 
this  concept.  Contrary  to  James  Coleman’s  (1990)  notion  that  the  decision  to  place  trust 
is  analogous  to  the  decision  to  place  a  bet,  placing  a  bet  has  no  trust  element.  If  a  person 
goes  to  a  casino  and  puts  money  in  a  slot  machine,  then  the  individual  is  taking  a  risk. 
The  individual  may  lose  or  win  money.  The  amount  of  risk  can  be  calculated  based  on 
the  odds  of  winning  money  (likelihood)  and  the  total  value  of  money  (consequence) 
placed  in  the  slot  machine.  The  entire  scenario  revolves  around  one’s  own  choice.  There 
is  no  individual  to  trust  and  therefore  no  element  of  trust  in  making  a  bet.  Another 
example  of  an  event  that  contains  risk  without  an  element  of  trust  is  a  man  cliff  diving 
into  the  ocean.  The  man  is  risking  his  life  (consequence)  for  the  adrenaline  rush 
(likelihood)  achieved  by  cliff  diving.  Though  there  is  a  risk  being  taken  by  cliff  diving, 
there  is  not  a  reliance  on  another  individual  and  therefore  no  element  of  trust.  Next, 
consider  the  reverse  question  of  whether  trust  can  exist  without  risk.  The  answer  is  “no.” 
As  backed  up  by  the  various  definitions  of  trust  from  Table  1,  when  an  individual  trusts 
someone  or  something  to  perform  a  task,  he  is  taking  a  risk  that  someone  or  something 
will  or  will  not  perform  the  task.  For  example,  if  someone  asks  a  friend  to  pick  him  up 
from  the  airport,  then  the  requestor  is  taking  a  risk  on  that  friend  showing  up  on  time  or  at 
all.  If  the  friend  is  late  to  arrive  at  the  designated  time,  then  the  requestor  will  lose 
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personal  time  that  eould  have  used  to  perform  other  tasks.  If  the  friend  does  not  show  up 
at  the  airport,  then  the  requestor  will  lose  the  time  it  takes  me  to  devise  a  new  plan,  the 
eost  (taxi,  or  rental  car),  and  the  additional  time  that  the  new  plan  incurs.  Therefore,  to 
capture  the  likelihood  and  consequence  of  an  action  that  requires  dependence  on  other 
individuals  to  take  action,  the  element  of  trust  should  be  assessed. 

B,  WHY  SHOULD  TRUST  BE  PART  OF  THE  DOD  PROCESS 

A  contract  is  a  binding  agreement  of  trust  between  the  government  and  contractor. 
The  government  clearly  defines  its  programmatic  and  technical  requirements  in  a  request 
for  proposal.  The  contractors  reply  with  their  proposal  to  the  contract  accepting  the  stated 
programmatic  and  technical  requirements  and  add  the  boundary  conditions  of  cost  and 
schedule.  Then  the  government  accepts  a  contractor’s  proposal  to  make  a  binding 
contract  between  the  two  parties.  Or  as  Howard  Shore  (2012,  np)  defined,  “contractual 
trust  is  trust  that  exists  only  to  the  extent  that  things  are  explicitly  agreed  upon  and  one 
can  only  trust  what  people  state  in  formal  agreements.”  The  DOD  acquisition  starting 
point  is  a  trusting  agreement  between  two  parties. 

Trust  is  also  essential  for  a  team  to  be  functional.  As  Patrick  Lencioni  (2002) 
points  out  in  his  book  The  Five  Dysfunctions  of  a  Team,  one  of  the  five  dysfunctions  of  a 
team  is  “the  absence  of  trust.”  Team  members  must  be  trust  one  another  to  be  able  to 
share  ideas,  different  opinions  and  mistakes  without  fear  of  ridicule  or  job  security. 
Ultimately,  the  IPT  should  reach  a  level  of  trust  that  the  contractor  is  doing  the  work 
required  to  achieve  the  final  goal.  However,  as  the  trust  level  decreases,  people  are 
slower  to  respond  and  less  likely  to  divulge  all  the  information.  Slow  and  incomplete 
communications  will  lead  to  delayed  and/or  bad  decisions  and  ultimately  increase 
programmatic  risks  to  cost  and  schedule.  Therefore,  the  government  and  contractor  have 
to  maintain  a  level  of  trust  to  minimize  the  potential  risk  elements  associated  from 
mistrust.  This  theory  is  also  supported  by  the  work  of  Eddy  Witzel  (2014)  exploring 
leader  attitudes  and  behaviors  that  drive  innovation.  He  found  that  both  trust  and  risk 
were  critical  and  were  in  tension.  When  a  leader  is  trusted,  that  leader  is  allowed  to  take 
more  risk.  When  the  risk  is  successfully  mitigated,  the  leader  gains  additional  trust. 
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However,  when  the  leader  fails,  trust  is  redueed  and  the  leader  is  prevented  from  taking 
risk.  It  is  hard  to  build  a  trusting  business  relationship  between  a  particular  contractor  and 
government  program  team  due  to  the  following  factors.  First,  the  government  is  a 
bureaucratic  entity  in  which  processes  rule  the  Acquisition  Strategy,  which  does  not 
allow  for  the  flexibility  of  corporate  relations.  There  can  be  no  side  agreements  to 
add/remove  capability  or  to  buy  more  products  unless  explicitly  stated  in  the  contract. 
Second,  the  government  contract  is  usually  for  one  product/service  with  a  contractor;  it 
buys  one  item.  There  are  no  guarantees  of  future  work  and  therefore  no  future 
dependency  on  the  relationship  with  that  company  for  the  next  project.  Therefore,  it  is 
very  important  to  monitor  the  trust  level  within  the  IPT  by  incorporating  the  element  of 
trust  into  the  risk  management  process. 

C.  TRUST  EXPRESSED  MATHEMATICALLY 

This  report  has  defined  trust,  its  relationship  with  risk,  and  why  it  is  important. 
The  next  task  is  to  determine  how  to  express  trust  mathematically  to  incorporate  trust  into 
the  DOD  Risk  Management  Process.  The  definition  of  business  trust  is  the  subjective 
probability  of  a  positive  outcome  from  an  agreement  between  two  or  more  parties  for  a 
domain  specific  task  based  on  the  capability  and  goodwill  of  the  trustee,  in  the  absence  of 
knowledge.  To  make  a  probabilistic  analysis  of  a  risk  item,  one  must  have  all  the  data  for 
that  event.  However,  the  element  of  trust  is  subjective,  and  there  is  not  a  complete  data 
set  to  make  a  probabilistic  analysis.  Subjective  probability  analysis  can  be  defined  using 
the  Dempster-Shafer  theory.  The  Dempster-Shafer  theory  is  based  the  idea  of  obtaining 
degrees  of  belief  (trust)  for  one  question  (risk  item)  from  subjective  probabilities  (trust 
factor)  (Shafer  1976).  The  Dempster-Shafer  theory  is  based  on  belief  (confidence)  and 
plausibility  (uncertainty)  which  matches  nicely  to  the  trust  definition.  In  addition,  the 
Dempster-Shafter  theory  also  allows  the  combination  of  evidence  from  different  sources 
to  arrive  at  a  degree  of  belief  for  a  related  question  (risk)  as  long  as  there  is  no  major 
conflict  between  the  sources  (Shafer  1976).  And  since  the  risk  management  members  are 
all  part  of  the  IPT  whose  goal  is  for  a  successful  program,  there  should  be  no  major 
conflict  between  data.  Therefore,  one  can  conclude  that  the  trust  elements  are  additive. 
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Trust  is  made  up  of  three  sub-elements:  eonfidenee,  vulnerability  and  uneertainty. 
To  combine  these  three  trust  elements  into  one  probability  factor,  a  weight  distribution 
for  these  factors  must  be  defined.  However,  each  of  the  trust  elements  is  subjective  with 
no  rationale  to  determine  which  element  is  more  plausible.  Therefore,  each  trust  element 
should  be  treated  as  equally  likely  to  occur.  This  is  supported  by  John  Keynes’s  principle 
of  indifference.  The  principle  of  indifference,  states  “if  there  is  no  known  reason  for 
predicating  of  our  subject  one  rather  than  another  of  several  alternatives,  then  relatively 
to  such  knowledge  the  assertions  of  each  of  these  alternatives  have  an  equal  probability” 
(Keynes  1921,  52-53) 

The  mathematical  relationship  between  risk  and  trust  will  now  be  defined.  Risk 
has  a  negative  connotation.  Only  under  certain  circumstances  do  companies  want  to  be 
known  for  taking  larger  risk,  for  instance  if  the  company  is  looking  at  competing  for 
market  share  against  a  larger  established  company  in  a  specific  product  market.  However, 
trust  has  a  positive  connotation.  Companies  and  people  desire  to  achieve  high  trust  as  a 
part  of  their  normal  operation.  So  trust  and  risk  are  inversely  related,  generally.  This 
theory  is  supported  by  psychometric  studies  of  risk  and  trust,  which  often  found  risk  and 
trust  to  be  inversely  related  (Siegrist  2010). 

RISK  =  C/TRUST  (where  C  is  a  constant). 

The  theory  of  quantitative  risk  management  was  explored  to  determine  whether  or 
not  to  combine  two  factors  of  risk  that  are  independent.  Alexander  McNeil  explains  how 
two  risk  factors  that  affect  the  outcome  of  an  event  are  considered  aggregate  risks.  Using 
the  axiom  of  coherence,  he  demonstrates  how  aggregate  risks  are  additive  “for  simple 
risks”  (McNeil  2005).  In  conclusion,  program  risk  could  be  equated  by  the  summing  the 
items  of  trust  or  items  of  risk.  However,  the  process  is  not  simple  mathematical  addition, 
since  trust  and  risk  are  inversely  related.  Gary  Langford’s  method  for  managing 
complexity  warranted  the  use  of  geometric  relationships  to  combine  risk  and  trust  into  a 
matrix  report  (Langford  2007). 
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1,  Geometric  Risk  and  Trust 

Based  on  the  taxonomy  of  eonfidenee,  vulnerability  and  uncertainty:  “An  element 

D 

of  a  system  is  associated  with  a  risk,  « ,  defined  by 

K  =X,U,V,  =XJl-aJV, 

9 

where  confidence,  ® ,  is  the  degree  to  which  harmful  events  could  impact  the  element; 
vulnerability,  is  the  probability  that  element  is  degraded  or  fails  in  some  specific 
way,  if  attacked;  value,  results  from  a  successful  attack  on  element  and 
uncertainty,  ,  is  the  likelihood  that  an  asset  will  be  found  acceptable  after  a  problem  is 
realized.  is  given  by 

As  in  (Langford  and  Huynh  2007),  the  system  value,  V(t),  is  given  by 

YF(t)P(t)Q(t) 

v(t)  =  — — - 

I(t) 

9 

where  is  a  function  performed  by  the  system,  is  the  performance  measure  of 

the  function  is  the  quality,  which  is  the  tolerance  assigned  to  is  the 

investment  of  energy,  matter,  material  wealth  (e.g.,  dollars  or  other  equivalent 
convenience  of  at-risk  assets),  and  information.  Time,  t,  is  measured  relative  to  the  onset 

of  period  of  interaction  for  which  the  system  is  at  risk.  If  the  unit  of^^^^  can  be 

converted  to  the  unit  of  ,  then  the  unit  of  V(t)  is  that  of  ,  since  is 

dimensionless  (Langford  2007).  Since  an  element  in  a  system  may  be  connected  to  more 
than  one  element,  the  number  of  interactions  of  each  element  is  related  to  the  number  of 
elements  and  the  number  of  links  between  the  elements. 

Subscribing  to  Mannai  and  Lewis  (2007),  we  obtain  the  system  risk,  R  ,  as 

2{n+m) 

R=^  Xfi-a,)g,V, 
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in  which  "  denotes  the  number  of  elements,  ^  the  number  of  links,  and  denotes  the 

•th 

degree  of  the  '  element”  (Langford  and  Huynh  2007). 

To  determine  the  number  of  elements  and  links,  one  must  use  the  geometric 
theory.  The  number  of  elements'”  is  determined  by  the  number  of  risk  or  trust  elements 
related  to  a  program  risk  and  the  links  is  ealculated  by  the  interfaces.  For  example,  if 
there  were  three  elements  of  risk  and/or  trust,  then  there  are  three  links  between  elements. 
For  four  elements  there  are  six  links  between  elements.  See  Figure  6. 


\.  3  elements 

•v  /• 

\ 

^  A  3  links 

•  # 

4  elements 
6  links 


Figure  6.  Geometric  Relationship  of  Trust  and  Risk  Elements 

The  result  of  this  proeess  is  to  end  up  with  a  tuple  of  trust  and  risk:  Tn  (1,2,3,...),  Rj 
(a,b,c,...)-  Therefore,  the  assessment  of  overall  combined  risk  and  trust  assessment  of 
program  risk  is  best  expressed  in  a  matrix  similar  to  the  current  Risk  Reporting  Matrix 
from  the  Risk  Management  Guide  for  DOD  Acquisition  (DOD  2006). 

D.  IMPLEMENTATION  OF  TRUST  IN  THE  DOD  RISK  MANAGEMENT 

PROCESS 

Chapter  III  summarizes  how  the  eurrent  Risk  Management  Proeess  for  DOD 
Acquisition  works.  Risks  are  identified,  evaluated  and  then  eaeh  risk  is  assigned  a  value 
on  the  Risk  Reporting  Matrix.  However,  first  one  must  define  the  values  of  the  rating 
seale.  In  the  case  of  the  aggregation  of  risk  and  trust,  the  risk  matrix  must  be  set  up  based 
on  the  preference  for  either  risk  aversion  or  trust  acceptanee.  Then  the  program  will  need 
to  define  the  meanings  of  risk  levels  (high,  moderate,  and  low)  and  the  meanings  of  trust 
levels  (high,  moderate,  and  low)  based  on  the  bias  for  their  acceptance  of  risk  and  trust.  If 
the  bias  toward  risk  is  that  of  high  risk  aversion  and  trust  is  deemed  to  be  less  important 
than  risk  (or,  alternatively  stated  as,  having  an  aversion  to  aeeepting  trust  as  high  except 
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in  the  most  extreme  cases),  then  the  following  mappings  of  risk  and  trust  to  their 
definitions  would  be  used  for  applying  the  aggregation  of  risk  and  trust  in  the  Risk 
Matrix,  Table  2.  One  must  remember  that  low  trust  is  equivalent  to  high  risk,  since  they 
are  inversely  related. 


Table  2.  Risk  and  Trust  Aggregate  Matrix 


Level 

Risk 

Trust 

High  (level  1) 

Possible,  but  not  probable 

Eow 

High  (level  2  <  level  1) 

Possible,  not  modeled 

Moderate 

High  (level  3  <  level  2) 

Possible,  modeled 

High 

Moderate  (level  4  <  level  3) 

Unconfirmed  /  Good 
Estimate 

Eow 

Moderate  (level  5  <  level  4) 

Unconfirmed  /  Fair  Estimate 

Moderate 

Moderate  (level  6  <  level  5) 

Unconfirmed  /  Rough 
Estimate 

High 

Low  (level  7  <  level  6) 

Confirmed  /  Sketched 

Eow 

Low  (level  8  <  level  7) 

Confirmed  /  Modeled 

Moderate 

Low  (level  9  <  level  8) 

Confirmed  /Demonstrated 

High 

To  help  demonstrate  how  to  implement  trust  into  the  Risk  Management  Process 
for  DOD  Acquisition,  an  example  will  be  provided  for  a  walk  through  demonstration  of 
the  process.  A  duplicate  figure  of  the  Risk  Management  Process  for  DOD  Acquisition  is 
added  for  reader  ease.  Figure  7. 
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Plan  Implementation 


Figure  7.  DOD  Risk  Program  Management  Proeess  (DOD  2006) 


Step  one  is  to  identify  a  risk.  For  this  example,  the  identified  program  risk  is 
“Delivery  of  late  s/w.”  Step  two  is  to  analyze  the  risk.  Assume  that  the  IPX  risk  board 
members  assessed  the  “Delivery  of  late  s/w”  risk  as  having  a  likelihood  of  two  and  a 
eonsequence  of  three  based  on  the  technical  information  that  was  available.  Using  the 
Risk  Reporting  Matrix  from  the  Risk  Management  Process  Guide  for  DOD  Acquisition, 
the  “Delivery  of  late  s/w”  risk  item  would  be  rated  as  a  low  risk,  as  presented  in  Figure  8. 
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1  2  3  4  5 


Consequence 


Figure  8.  Risk  Reporting  Example 

Following  the  current  risk  management  process,  the  program  risk  board  would 
move  on  to  develop  some  mitigation  steps  for  this  risk  item.  Flowever,  this  process  would 
not  account  for  the  trust  element  of  risk  and  not  fully  define  the  entire  risk  item. 
Therefore,  the  risk  analysis  section  should  be  further  decomposed  by  implementing  a 
trust  element  analysis.  The  next  step  is  to  identify  whether  trust  elements  exist,  and  then 
analyze  each  trust  element.  As  part  of  the  trust  assessment,  the  risk  board  would  have  to 
address  questions  such  as;  1)  are  the  programmers  capable  of  completing  the  task 
(confidence)?  2)  does  management  think  that  this  program  is  a  high  priority  to  the 
contractor  and  has  the  contractor  applied  the  right  resources  to  get  the  task  completed 
(vulnerability)?  and  3)  are  the  requirements  ill  defined  (uncertainty)?  These  are  just  a  few 
examples  of  questions,  which  are  based  on  trust  that  are  rarely  asked  at  risk  management 
board  reviews.  The  proposed  risk  analysis  section  breakdown  of  the  Risk  Management 
Process  for  DOD  Acquisition  is  shown  in  Figure  9. 
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Figure  9.  Risk  Analysis  with  Trust  Factors 


The  same  example  will  now  be  evaluated  using  the  risk  and  trust  aggregate 
method.  The  risk  identified  was  “Delivery  of  late  s/w.”  This  risk  was  initially  assigned  as 
a  likelihood  of  two  and  a  consequence  of  three  based  on  technical  data  and  therefore 
rated  as  a  low  risk.  To  determine  whether  the  identified  risk  has  a  trust  element,  the  risk 
members  must  conclude  that  the  risk  item  is  dependent  on  others.  In  order  to  have  an 
element  of  trust,  the  risk  must  rely  on  a  second  party  to  perform  a  task.  In  the  case  of  the 
risk  item  “late  software  delivery,”  the  answer  is  yes.  The  next  step  is  to  analyze  the  risk 
element  for  a  confidence  element.  To  reiterate,  confidence  in  business  is  defined  as  the 
belief  that  the  partner  has  the  tools  and  capability  to  perform  the  task  that  is  required. 
Since  delivering  s/w  is  a  task  reliant  upon  a  business  partner,  the  answer  is  yes.  Potential 
questions  to  address  could  be,  are  the  programmers  capable  of  completing  the  task 
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(confidence)?  Or  does  management  have  a  plan  to  apply  the  right  resources  to  get  the 
task  completed  (confidence)?  The  above  two  questions  relate  to  the  confidence  that  the 
stakeholders  have  in  the  ability  of  the  contractors  in  delivering  the  software  on  time. 

If  the  stakeholders  (all  IPX  members)  were  to  rate  their  confidence  value  on  these 
questions  related  to  the  risk  item,  using  the  Dempster-Shafter  theory,  the  overall  trust 
rating  could  increase  or  decrease  the  risk.  For  example,  if  there  were  ten  members  of  the 
IPX  and  they  were  all  asked  to  rate  their  trust  value  (percentage  0-100)  for  each  question, 
one  would  get  a  confidence  value  for  this  risk.  Confidence  levels  of  low,  medium,  and 
high  must  be  defined  prior  to  performing  the  confidence  level  analysis  to  keep  the 
analysis  unbiased.  Table  3  provides  the  confidence  level  definitions  based  on  the  mean 
value  collected  from  the  risk  management  team  confidence  ratings. 


Tables.  Confidence  Level  Definitions 


Confidence  Level 

Value 

High 

0-0.30 

Medium 

>0.30-0.70 

Low 

>0.70-100 

The  confidence  level  inputs  from  the  risk  board  members  should  be  evaluated 
against  the  programs  set  confidence  level  definitions.  One  must  be  careful  to  word  the 
question  in  a  positive  way  to  get  the  correct  percentage.  For  example,  one  should  ask, 
“What  is  your  trust  level  that  the  s/w  programmers  can  complete  the  task?”  versus  “Do 
you  think  the  s/w  programmers  can  complete  the  task?”  Table  4  presents  the  synthesized 
data  for  this  example. 
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Table  4.  Confidence  Level  Data  (Sample  Data) 


Person 

Subjective  Trust  Value 

1 

0.4 

2 

0.3 

3 

0.6 

4 

0.5 

5 

0.8 

6 

0.3 

7 

0.4 

8 

0.5 

9 

0.6 

10 

0.5 

Total 

4.9 

Mean 

0.49 

Result 

Medium  Confidence 

The  data  does  not  indicate  any  conflict  and  should  be  considered  valid.  The 
resultant  trust  factor  for  the  confidence  element  is  medium.  This  process  needs  to  be 
repeated  for  the  other  confidence  question.  For  brevity’s  sake,  assume  that  the  group  has 
a  low  trust  level  (0.8)  that  the  program  manager  has  a  plan  for  the  s/w  development. 
There  are  two  trust  elements  from  the  confidence  element  that  are  classified  as  medium 
and  high. 

Next,  the  stakeholders  have  to  assess  whether  the  risk  item  has  an  element  of 
vulnerability.  Vulnerability  is  defined  as  “the  expectation  that  an  exchange  partner  will 
not  engage  in  opportunistic  behavior,  even  in  the  face  of  countervailing  short-term 
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incentives  and  uncertainty  about  long-term  benefits”  (Chiles  and  MeMaekin  1996,  85). 
Trust  is  a  positive  term  and  vulnerability  is  more  negative  so  the  foeus  is  on  the  rating  of 
vulnerability  toward  the  working  relationship  and  communication  (team  cohesion) 
between  the  parties.  As  mentioned  before,  with  respect  to  the  book  5  Dysfunctions  of  a 
Team,  a  good  indication  of  a  partner’s  vulnerability  level  is  the  health  of  communication 
between  team  members.  Providing  a  subjective  probability  on  the  working  relationship 
that  does  not  contain  conflict  data  and  skew  results  may  be  difficult  (due  to  personal 
friendship  bias).  Therefore,  when  assessing  the  vulnerability  of  a  risk  item,  it  is 
reeommended  to  use  the  definitions  of  high,  medium  and  low  vulnerability  presented  in 
Table  5. 


Table  5.  Vulnerability  Level  Definition 


Vulnerability  Level  (Working  Relationship 
/Team  Cohesion) 

Definition 

High 

Worked  with  this  company  multiple  times 
on  similar  scoped  efforts,  open 
eommunication  is  great 

Medium 

Work  with  this  company  once  before  on  a 
smaller  effort,  but  they  have  worked  with 
other  agencies,  communication  is  good  but 
not  immediate 

Low 

Never  worked  with  the  company  before, 
this  is  their  first  effort  of  this  magnitude, 
communication  is  bad,  employees  must 
always  go  through  supervisor  before 
responding 

Examples  of  vulnerability  questions  are:  1)  Do  the  s/w  programmers  personally 
benefit  (i.e.,  bonuses)  from  the  program’s  suecess  and/or  getting  the  s/w  completed  on 
time?  2)  Is  the  company  acting  in  self-interest,  or  are  they  concerned  about  the  success  of 
the  program?  In  addition,  this  approach  to  rating  vulnerability  should  also  be  applied  to 
the  relationships  between  the  prime  contractor  and  their  sub-contract  teams.  An  example 
question  would  be  “Are  the  prime  contractor  and  subcontractor  communicating 

53 


frequently  and  well?”  For  this  researeh  example,  the  program  offiee  has  never  worked 
with  this  eontraetor  before,  but  the  eontraetor  has  work  with  other  government  ageneies. 
During  the  engineering  development  phase,  the  eontraetor  team  has  identified  some  s/w 
problems  but  hesitates  on  eommunieating  the  problems  to  the  government  eustomer  until 
the  manager  sets  up  a  formal  meeting.  Based  on  this  seenario,  the  IPX  risk  board 
members  identified  two  vulnerability  risks:  laek  of  experienee  with  eontraetor  and 
eommunieation  slow  down.  Even  though  the  IPX  has  not  worked  with  the  eontraetor 
before,  other  government  ageneies  have  so  the  risk  board  members  assessed  the  first 
vulnerability  risk  as  medium.  Xhe  delay  in  eommunieation  should  start  to  worry  the  team, 
sinee  IPX  eannot  get  direet  answers  to  questions,  so  the  IPX  risk  board  assessed  this 
vulnerability  as  low. 

Xhe  risk  management  team  would  eomplete  the  risk  analysis  with  an  assessment 
of  the  risk’s  uneertainties.  Uneertainty  has  a  negative  eonnotation,  so  to  keep  the  ratings 
eonsistenee  with  the  other  ratings,  one  should  rate  the  level  of  uneertainty  as  the 
predietability  level.  Uneertainty  ean  be  diffieult  beeause  it  is  based  entirely  on  the  future 
and  what  one  does  not  know.  Xherefore,  when  assessing  the  uneertainty  of  a  risk  item,  it 
is  reeommended  to  use  the  following  default  rating  seale,  see  Xable  6. 


Xable  6.  Uneertainty  Level  Definition 


Uneertainty  Level  (Predietability) 

Definition 

High 

Company  has  multiple  experienees  with 
this  teehnology  and  implementation 

Medium 

Company  has  used  this  teehnology  but  not 
for  this  applieation 

Low 

Company  is  inexperieneed  with  this 
teehnology 

For  this  researeh  example,  the  program  requires  eonverting  an  old  eomputer 
language  (FORXRAN)  to  C++.  Currently,  the  software  employee  staff  does  not  have  a 
FORERAN  software  programmer  with  professional  experienee.  As  a  result,  the  risk 
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management  team  looks  at  the  uneertainty  level  definition  table  and  assessed  the 
uneertainty  of  the  contractor  to  deliver  s/w  on-time  as  low  because  the  company  has  no 
prior  experience  with  the  FORTRAN  software  language. 

The  summary  of  the  completed  risk  analysis  of  risk  item  “Delivery  of  late  s/w”  is 
presented  in  Table  7. 


Table  7.  Risk  and  Trust  Aggregate  Example  Summary 


Risk  Element 

Technical  Risk  Fevel 

Fow 

Confidence  #1 

Medium 

Confidence  #2 

Fow 

Vulnerability  #1 

Fow 

Vulnerability  #2 

Medium 

Uncertainty 

Fow 

Taking  all  the  risk  elements  and  plotting  them  against  the  risk  reporting  matrix, 
the  aggregate  would  be  a  medium  risk  (level  6).  For  the  example,  the  addition  of 
analyzing  trust  raised  the  level  of  risk.  This  analysis  now  gives  the  program  manager 
more  insight  into  the  root  cause  of  the  risk  and  a  better  ability  to  manage/mitigate  this 
risk  with  resources.  It  is  important  to  note  that  trust  is  time  dependent,  and  the  level  of 
trust  can  change  rapidly.  For  example,  a  troublesome  employee  could  be  replaced  by 
someone  more  competent.  This  action  could  improve  confidence,  vulnerability  (working 
relations)  and  uncertainty  (if  the  person  were  a  FORTRAN  s/w  expert).  Therefore,  risk 
with  trust  elements  must  be  monitored  on  a  periodic  schedule  to  manage  trends  as  early 
as  possible. 

As  a  result  one  can  conclude  that  TRFIST  must  be  included  as  part  of  the  risk 
management  process  to  accurately  identify  cost,  schedule,  and  technical  risks  that  may 
occur  in  the  future  of  a  program. 


55 


E,  STAKEHOLDER  BUY-IN 

So  this  leads  into  the  next  consideration,  “How  will  this  affect  the  stakeholders  of 
this  process?”  All  the  immediate  stakeholders  that  this  process  will  affect  were  listed  in 
Table  8.  Direct  stakeholders  are  individuals  or  groups  that  are  engaged  in  risk 
management  process  and  the  program  contract.  They  include  companies,  customers, 
suppliers,  government  and  contractor  employees,  policy  makers,  lawyers,  and 
stockholders.  Indirect  stakeholders  were  defined  as  individual  or  groups  who  are  not 
engaged  in  the  risk  management  process  and  program  contract  but  may  be  affected  by  or 
can  affect  its  actions.  They  include  the  general  public  (tax  payers),  communities,  activist 
groups,  business  support  groups  and  the  media.  After  the  stakeholders  were  identified, 
the  stakeholders  were  ranked  based  on  their  impact  to  the  success  of  the  project.  The 
stakeholder  requirements,  needs  and  wants,  were  listed  to  ensure  they  were  addressed 
(not  necessarily  met).  Table  8  lists  the  top  three  rated  stakeholders  that  this  process 
affects. 


Table  8.  Stakeholder  List 


Ranking 

Stakeholder 

Requirements/W  ants/Needs 

1 

The  Integrate  Program  Team 
(Gov) 

The  Program  Executive 
Office 

Develop  a  higher  fidelity  Risk  Management  Tool  to  improve  program 
success 

Create  an  unbiased  way  to  measure  Risk  on  program  success 

Deliver  a  product  to  the  fleet  that  meets  their  requirements  to  complete  the 
mission 

Deliver  a  quality  product  at  the  lowest  cost  as  quickly  as  possible 

Quickly  identify  high  risk  tasks  that  may  impede  the  program  to  meet  cost 
and  schedule 

Spend  less  time  in  meetings 

Contractor  Business  Team 
Contractor  IPT 

Win  the  contract  to  make  a  profit 

Deliver  a  product  to  the  fleet  that  meets  their  requirements  to  complete  the 
mission 

Deliver  a  quality  product  as  quickly  as  possible  to  build  a  good  company 
reputation 

2 

Tax  Payers 

Protect  my  tax  dollars  with  a  good  investment  decision 

Fleet  Operators 

Provide  a  quality  product  quickly  at  the  lowest  cost 

Provide  a  product  that  meets  my  requirements  to  complete  my  mission 

DOD  Contracts 

Ensure  all  the  requirements  are  being  met 

Ensure  the  contractor  is  fulfilling  his  obligations 

Quickly  identify  contract  disagreements 
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Implementing  the  risk  and  trust  aggregate  risk  proeess  will  likely  be  met  with 
aversion  and  skeptieism.  The  proposed  ehange  of  ineorporating  trust  to  the  eurrent  risk 
management  proeess  for  DOD  aequisition  is  an  evolution  ehange  and  therefore  ean  be 
implemented  rather  easily  with  little  training  or  disruption  to  the  work  eulture  of  risk 
management.  The  addition  of  the  trust  element  emphasizes  the  need  for  good 
eommunieation  and  team  eohesion.  As  trust  builds,  less  time  is  required  on  monitoring 
eaeh  other,  so  validating  progress  and  deeisions  ean  be  made  faster.  These  notions  are 
supported  by  Naval  Air  Systems  Command  leadership  of  staying  foeused  on  the  intent  of 
the  proeess  and  not  over  burdening  the  team  in  an  effort  to  deliver  a  produet  to  the  fleet 
faster. 

This  ehapter  evaluated  the  feasibility  and  value  of  ineorporation  trust  into  the 
DOD  risk  management  proeess.  Through  logie  and  psyehometries  studies  of  risk  and 
trust,  it  was  determined  that  risk  and  trust  were  inversely  related.  The  Dempster-Shafer 
theory  was  used  to  prove  that  trust  elements  eould  be  added  long  as  there  is  no  major 
oonfliet  between  the  sourees.  The  prineiple  of  indifferenee  (Keynes  1921)  supported  the 
theory  that  eaeh  element  should  be  weighed  equally  sinee  we  have  no  idea  whieh  element 
is  more  plausible.  Alexander  MeNeiTs  (2005)  researeh  on  the  axiom  of  eoherenee  was 
applied  to  eonelude  that  risk  and  trust  elements  were  additive.  Gary  Langford’s  (2007) 
method  for  managing  eomplexity  warranted  the  use  of  geometrie  relationships  to 
eombine  risk  and  trust  into  a  matrix  report.  A  detailed  step-by-step  example  of  how  to 
take  a  risk  item  through  the  proposed  risk  and  trust  management  proeess  for  DOD 
aequisition  was  deseribed.  Qualitative  assessment  measurement  definitions  for  all  three 
trust  elements;  eonfidenee,  vulnerability,  and  uneertainty  were  ereated.  The  risk 
management  example  highlighted  how  a  risk  item  that  was  assessed  quantitatively  as  a 
low  risk  was  raised  to  a  medium  risk  when  qualitative  measurements  (trust)  were 
ineluded  in  the  evaluation.  A  stakeholder  analysis  was  eondueted  to  assess  the  impaet  of 
ineorporating  trust  and  the  potential  buy-in.  The  following  ehapter  will  examine  a  ease 
study  of  the  Boeing  787  Dreamliner  to  support  the  value  of  ineorporating  trust  into  the 
risk  management  proeess. 
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V.  BOEING  787  DREAMLINER  CASE  STUDY 


The  Boeing  787  Dreamliner  ease  study  will  be  used  as  a  qualitative  researeh  tool 
to  evaluate  the  whether  trust  is  a  valuable  faetor  in  the  risk  assessment  proeess  in 
identifying  qualitative  risk  elements.  The  acceptance  of  using  case  studies  as  a  legitimate 
research  technique  is  still  debatable.  The  following  sections  will  provide  a  brief  history  of 
case  study  research,  define  case  study  and  provide  rationale  for  using  a  case  study  under 
certain  conditions.  The  Boeing  787  Dreamliner  case  study  was  evaluated  against  the 
Robert  Yin’s  research  on  case  study  design  and  methods  (Yin  2009)  and  Gary  Langford’s 
research  on  engineering  methods  (Langford  2012).  Once  validated,  the  Boeing  787 
Dreamliner  case  study  was  used  to  evaluate  the  research  question  of  how  the  addition  of 
trust  could  serve  to  identify  qualitative  risks  to  facilitate  better  management  decisions. 
Figure  10  presents  a  picture  of  the  Boeing  787  Dreamliner  aircraft. 


Figure  10.  Boeing  787  Dreamliner 


A,  VALIDATION  OF  CASE  STUDY  RESEARCH 
1,  History  of  Case  Studies 

It  can  be  difficult  to  conduct  qualitative  research  because  of  its  exploratory  and 
subjective  nature.  There  is  only  so  much  quantitative  research  and  quantitative  data  that 
can  be  found  and  analyze  in  order  to  validate  social  theories.  That  is  why  case  study 
research  has  been  valuable  to  the  field  of  qualitative  research  in  social  sciences.  Case 
studies  allowed  social  sciences  to  study  human  behavior  from  different  aspects  and 
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perspectives.  However,  the  acceptance  of  using  case  studies  has  been  debated  since  the 
early  1900s  as  a  legitimate  research  technique  (Tellis  1997).  The  first  generation  of  case 
studies  culminated  in  the  Chicago  school  of  sociology,  in  which  the  anthropologist’s  field 
study  method  was  practiced  (Platt  1992).  Chicago  was  the  center  for  immigration  and 
industry  in  the  1920s,  which  allotted  it  various  ethnical  backgrounds  and  poverty  levels 
for  the  university  social  researchers  to  study  (Hamel  et  al.  1993).  After  the  Second  World 
War,  social  science  became  dominated  by  the  aspiration  for  quantitative  analysis,  called 
positivism.  These  positivism  advocates  called  case  study  research  soft  science  and 
criticized  the  methodology  for  not  being  scientific  because  of  its  qualitative  nature.  To 
avoid  criticism,  a  majority  of  social  science  researchers  went  back  to  taking  surveys, 
opinion  polls,  and  developing  quasi-experiments.  Case  study  research  was  mostly  dead 
until  Glaser  &  Strauss  introduced  Grounded  Theory  in  1967  (Johansson  2003).  Grounded 
Theory  is  a  disciplined  research  method  that  advocated  researchers  to  combine  both 
quantitative  and  qualitative  data  to  better  appreciate  the  entire  context  of  the  research 
question  being  analyzed.  The  social  science  community  seemed  to  accept  this  solution 
and  so  no  significant  advancements  in  the  area  of  promoting  case  study  research  were 
made  until  the  1980s.  Robert  Yin  took  the  next  step  and  developed  case  study 
methodology  to  make  it  a  rigorous  and  repeatable  scientific  method.  He  transferred 
experimental  logic  into  the  field  of  naturalistic  inquiry  and  combined  it  with  qualitative 
methods.  Since  the  1990s,  there  had  been  as  increase  in  literature  on  case  study 
methodology  (Johansson  2003).  Figure  1 1  depicts  the  history  of  case  study  methodology. 
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Figure  1 1 .  History  of  Case  Study  Methodology  (from  Johansson  2003) 

A  common  criticism  of  the  use  of  case  studies  for  research  is  that  its  dependence 
on  a  single  case  renders  it  incapable  of  providing  generalizing  conclusions  because  it 
lacked  a  sufficient  number  of  relevant  examples.  Hamel  (Hamel  et  al.  1993)  and  Yin 
(1984/1994)  forcefully  argued  that  the  relative  size  of  the  sample  whether  2,  10,  or  100 
cases  are  used,  does  not  transform  a  multiple  case  into  a  macroscopic  study.  The  goal  of 
the  study  should  establish  the  parameters,  and  then  should  be  applied  to  all  research.  In 
this  way,  even  a  single  case  could  be  considered  acceptable,  provided  it  met  the 
established  objective  (Tellis  1997).  Yin  is  one  of  the  leaders  in  case  study  research  and 
has  developed  rigorous  methods  with  which  a  case  is  constructed.  His  detailed  case  study 
methodology  fulfdls  the  three  tenets  of  the  qualitative  method:  describing,  understanding, 
and  explaining.  Yin  continues  his  research  on  case  studies  and  case  study  methodology 
because  he  understands  the  benefits.  According  to  Yin  (2003a,  2)  “the  distinctive  need 
for  case  studies  arises  out  of  the  desire  to  understand  complex  social  phenomena” 
because  “the  case  study  method  allows  investigators  to  retain  the  holistic  and  meaningful 
characteristics  of  real-life  events,”  such  as  organizational  and  managerial  processes.  The 
benefit  can  be  taken  from  the  following  heuristic,  “Good  decisions  come  from 
experience,  and  experience  comes  from  bad  decisions”  (Author  Unknown).  Currently, 
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case  studies  are  used  by  multiple  diseiplines  such  as:  psychology,  sociology,  political 
science,  anthropology,  edueation,  medieine,  eommunity  planning,  and  systems 
engineering.  But  even  with  all  the  eurrent  researeh  and  field  expert  baeking,  the  merits  of 
ease  study  research  are  still  debated  today. 

2.  Case  Study  and  Case  Study  Validation 

In  order  to  validate  the  use  of  a  case  study,  it  is  important  to  define  a  ease  study. 
Yin  (2003a,  13-14)  defines  a  ease  study  as  “an  emp ideal  inquiry  that  investigates  a 
contemporary  phenomenon  within  its  real-life  eontext,  espeeially  when  the  boundaries 
between  phenomenon  and  eontext  are  not  elearly  evident.”  In  other  words,  a  ease  study  is 
an  analysis  of  a  past  event  that  looks  at  all  the  proeesses  and  behavior  eonditions  that  led 
up  to  the  outeome  of  that  pariieular  event.  The  Boeing  787  Dreamliner  ease  study  fits  this 
definition.  The  Boeing  787  Dreamliner  ease  study  eonducted  by  Yao  was  a 
eomprehensive  empirical  study  of  the  aetual  events,  proeess  and  faets  of  the  design  and 
manufacturing  process  of  the  Boeing  787  Dreamliner  aireraft.  But  a  ease  study  is  not  just 
a  historieal  aeeount  about  what  had  happened.  The  case  study  must  have  a  problem  for 
the  researeher  to  solve.  To  address  this  defined  problem,  the  researeher  must  design  a 
researeh  strategy  that  eneompassed  the  required  step  to  eondueting  a  valid  ease  study.  A 
researeh  design  is  as  a  “blueprint”  for  the  research,  dealing  with  at  least  four  problems: 
what  questions  to  study,  what  data  are  relevant,  what  data  to  eolleet,  and  how  to  analyze 
the  results  (Philliber,  Sehwab,  and  Samsloss  1980).  To  start,  the  researeher  should 
determine  whether  the  ease  study  will  be  one  of  three  possible  types  exploratory, 
deseriptive  or  explanatory.  Aeeording  to  Yin,  one  needs  to  elassify  the  type  of  researeh 
question  being  asked.  Researeh  questions  that  ask  the  “how”  and  “why”  questions  are 
more  explanatory  and  more  likely  to  lead  to  the  use  of  ease  studies,  histories,  and 
experiments  as  the  preferred  researeh  methods  (Yin  2009).  For  ease  studies, 
contemporary  events  are  preferred  over  historieal  events  beeause  aeeess  to  researeh 
material  sueh  as  personal  interviews,  eurrent  doeumentation,  and  artifaets  has  not  been 
manipulated  over  time.  The  Boeing  787  Dreamliner  ease  study  is  eonsidered  explanatory. 
The  researcher,  Yao,  was  trying  to  solve  the  problem  of  “how  and  why  was  the  Boeing 
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787  Dreamliner  manufaeturing  delayed?”  Aeeording  to  Yin  (2009),  a  case  study  should 
contain  fives  components  of  research  design: 

1.  a  study’s  questions; 

2.  its  propositions,  if  any; 

3.  its  units  of  analysis; 

4.  the  logic  linking  the  data  to  the  propositions;  and 

5.  the  criteria  for  interpreting  the  findings. 

To  this  list,  Langford  adds  the  following  comments  about  the  scope  of  the 
research.  All  events  cannot  be  considered.  Therefore,  the  scope  of  the  research  needs  to 
be  constructed  carefully  to  capture  the  causal  event  that  links  to  the  problem.  Scope 
outlines  the  applicability  of  the  tasks  to  the  research.  The  scope  of  a  research  program 
determines  the  completeness  for  a  given  event’s  causal  relation  to  the  questions  of  “how” 
and  “why.”  Since  events  have  assumptions,  those  assumptions  are  tested  for  validity  as 
part  of  the  determination  of  validity  of  the  case  study  based  on  the  event  selected. 
Another  way  of  thinking  about  scope  is  that  scope  is  the  matchup  of  the  boundaries  of  the 
event  that  are  relevant  over  the  life  cycle  of  the  problem.  The  scope  of  the  research  deals 
with  the  problem  as  that  resulting  from  a  systemic  issue  that  is  endogenous  to  the  system. 
But  the  boundaries  of  the  scope  are  less  than  the  boundaries  of  the  research.  Scope 
determines  the  completeness  for  a  given  event  in  terms  of  its  causal  effect  on  the  efficacy 
of  the  research,  and  therefore  its  validity  (Langford  2012). 

3.  The  Boeing  787  Dreamliner 

The  Boeing  787  Dreamliner  first  flew  on  December  15,  2009,  under  the  guidance 
of  the  Boeing  Test  and  Evaluation  team.  However,  the  path  to  the  world’s  first  delivery  to 
All  Nippon  Airways  on  September  25,  201 1,  was  marked  by  a  40-month  delay  costing  an 
additional  $10  billion.  The  economic  realities  of  benefit  for  the  Dreamliner  customers 
were  to  replace  the  300-400  passenger  Boeing  777  as  it  was  believed  to  have  been  too 
expensive  and  too  slow  to  return  its  investment  to  shareholders”  (Flightglobal  2014).  The 
Dreamliner  was  premised  on  satisfying  a  business  development  strategy  of  delivering  the 
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aircraft  faster,  building  it  better,  and  making  it  cheaper  (Denning  2013).  The  result  was 
intended  to  be  a  three-phased  development  approaeh  that  first  pushed  the  supply  ehain  to 
deliver  faster,  then  integrating  significantly  better  performance,  whieh  precipitates  a 
redesign  for  lower  eost.  Piepenbroek’s  theoretieal  framework  of  Enterprise  Arehiteeture, 
Competitive  Dynamics,  Industrial  Evolution,  and  Eirm  Performance  (Piepenbroek  2004) 
summarizes  the  evolution  of  businesses  based  on  solid  product  offerings  that  inspire 
customers  to  purehase.  With  regard  to  risk,  the  concatenation  within  the  Piepenbroek 
framework  is  ontologieally  questionable,  as  there  is  a  conflict  of  objectives  without 
incorporating  the  feedback  from  one  stage  to  the  next.  Risk  is  premised  on  the  likelihood 
of  a  problem  eoupled  with  the  consequence  of  that  problem.  Without  a  feedbaek 
mechanism,  risk  within  such  a  framework  would  only  grow  as  the  projeet  progresses.  As 
with  the  systems  engineering  process  models  without  feedback,  the  requirements  stated  at 
the  onset  of  the  projeet  were  not  meant  to  be  ehanged.  As  is  the  ease  with  researeh- 
inspired  development,  requirements  posed  at  the  beginning  of  a  project  as  meant  to  be 
changed  as  a  consequenee  of  diseoveries  made  during  the  progression  of  the  work.  The 
Piepenbroek  framework  is  theoretical  and  perfectly  suitable  for  traditional  risk  analyses. 
However,  the  notion  of  trust  is  missing  from  the  Piepenbroek  framework. 

The  Boeing  Case  study  will  be  analyzed  against  Yin’s  (2009  fives  components  of 
researeh  design.  The  first  component  required  for  ease  study  researeh  methodology  is  a 
elear  ease  study  question.  The  case  study  question  will  guide  the  entire  case  study 
process.  As  discussed  earlier,  research  questions  that  ask  the  “how”  and  “why”  questions 
are  more  explanatory  and  more  applicable  to  case  study  research.  The  study  question  for 
the  Boeing  787  Dreamliner  case  study  was,  “how  and  why  was  the  Boeing  787 
Dreamliner  manufacturing  delayed?”  The  second  component  of  case  study  methodology 
is  to  determine  the  propositions.  Propositions  are  similar  to  thesis  research  questions,  in 
that  they  direct  attention  to  a  certain  location  or  person(s)  that  should  be  examined  during 
researeh.  These  questions  point  the  researeher  in  the  direetion  of  where  to  uneover 
evidenee.  There  is  no  hard  evidence  that  Yao  created  propositions  when  condueting  the 
Boeing  787  Dreamliner  case.  However,  one  can  conclude  Yao  must  have  ereated  a 
proposition,  since  he  was  able  to  uncover  the  cause  of  the  problem  and  obtained  enough 
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empirical  evidence  to  substantiate  his  claims.  The  third  component  of  case  study 
methodology  is  the  unit  of  analysis.  The  unit  of  analysis  is  described  as  the  case  that  is 
being  solved.  The  researchers  need  to  identify  whether  they  are  investigating  a  group  of 
people,  a  single  individual,  or  company.  The  unit  of  analysis  should  be  related  to  the 
initial  study  question  so  it  will  help  focus  the  researcher’s  proposition  questions  on  the 
case  being  examined.  For  the  Boeing  787  Dreamliner  case  study,  the  researcher’s  unit  of 
analysis  was  the  100  outsourcing  suppliers  that  Boeing  had  contracted  for  aircraft 
development  and  manufacturing.  The  fourth  step  to  case  study  methodology  is  linking 
data  to  the  previous  propositions.  During  this  phase,  the  researcher  has  taken  all  the  data 
that  is  collected  and  is  trying  to  discover  patterns  or  collaborative  details  to  support  the 
research  question.  Common  methods  for  linking  data  found  during  the  case  study  to 
propositions  are  pattern  matching,  explanation  building,  time-series  analysis,  logic 
models,  and  cross-case  synthesis  (Yin  2009).  For  the  Boeing  case  study,  Mr.  Zhao  used 
“an  integrated  empirical-analytical  approach  where  we  combine  a  comprehensive 
empirical  study  of  the  actual  events  and  facts  with  an  economic  analysis  of  financial 
incentives,  gaming  and  risk  in  joint  development  programs”  (Zhao  2012,  2).  The  fifth 
component  for  case  study  methodology  is  the  criteria  for  interpreting  a  case  study’s 
findings.  A  major  and  important  alternative  strategy  is  to  identify  and  address  rival 
explanations  for  the  findings  (Yin  2009).  In  other  words,  the  researcher  has  to  be 
prepared  that  the  same  scenario  may  be  interpreted  and/or  explained  opposing  ways  from 
multiple  sources.  As  a  result,  the  researcher  must  decide  on  which  source  will  have 
greater  weight  in  a  given  scenario  prior  to  the  data  collection  and  analysis.  Yao 
reconciled  the  qualitative  analysis  with  practical  evidence.  He  compared  the  data  that  was 
collected  to  the  actions  of  the  suppliers.  The  “reconciliation  clearly  shows  that  the  delays 
occurred  not  because  the  suppliers  weren’t  able  to  do  their  jobs  well  but  because  they  just 
didn’t  want  or  care  enough  to  do  it  well”  (Zhao  2012,  12). 

The  Boeing  Case  study  will  be  evaluated  against  the  Langford’s  (2012)  scope 
component  of  case  study  research  methodology.  The  scope  can  be  defined  as  the  work 
that  is  necessary  to  complete  the  project,  the  case  study  research.  The  scope  of  a  research 
program  determines  the  completeness  for  a  given  event’s  causal  relation  to  the  questions 
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of  “how”  and  “why”  (Langford  2012).  The  Boeing  787  ease  study  eovered  the  787 
development  baekground,  the  development  ehain,  the  management  of  the  supply  ehain, 
the  delay  events,  and  an  eeonomie  analysis.  The  baekground  study  of  the  Boeing  ease 
study  was  used  to  develop  the  proposition  links  by  defining  all  the  pieee  and  proeess  that 
were  used  to  manufaeture  the  test  artiele.  The  development  (supply)  ehain  was  analyzed 
to  determine  how  the  outsoureing  strueture  was  used  and  how  well  it  was  being  managed. 
Eaeh  identified  delay  event  (sueh  as  insuffieient  fasteners)  was  analyzed  to  subsidize  the 
supply  ehain  and  management  proeess  researeh  to  develop  a  eomplete  pieture  of  what 
really  happened.  An  eeonomie  analysis  was  eondueted  “to  understand  the  firms’  finaneial 
ineentives  and  unveil  the  trap  indueed  by  the  risk  sharing  partnership”  (Zhao  2012,  2). 
Sinee  all  events  eannot  be  eonsidered,  assumptions  must  be  made  and  tested  for  validity 
as  part  of  the  determination  of  validity  of  the  ease  study  (Langford  2012).  One  of  the 
assumptions  made  Boeing  was  eonfident  in  their  partnerships.  There  is  no  direet  evidenee 
in  the  eonfidenee  level  of  Boeing  with  its  suppliers;  however,  Boeing  did  delegate  all 
responsibility  to  the  Tier  one  suppliers  for  design  and  integration.  The  seeond  assumption 
made  was  that  Boeing  and  the  suppliers  were  following  good  business  praetiee  of  trying 
to  make  money.  It  was  determined  “that  eaeh  firm  tried  to  delay  behind  the  sehedule  or 
passed  its  unfinished  work  to  others  beeause  by  doing  so,  it  ean  save  its  direet  eosts” 
(Zhao  2012,  13). 

In  summary,  the  Boeing  787  Dreamliner  ease  study  met  all  the  eriteria  for  being 
elassified  as  a  ease  study.  The  ease  study  researeh  followed  the  rigorous  methodology 
aeeepted  by  the  field  of  soeial  seienee  and  doeumented  by  the  leading  ease  study 
researeher  Yin.  The  ease  study  researeher  had  no  finaneial  ties  to  any  of  the  stakeholders. 
The  eonelusions  were  based  on  a  triangulated  researeh  eolleetion  of  interview,  artifaets, 
and  doeumentation.  Therefore,  the  Boeing  787  ease  study  ean  be  eonsidered  valid  for 
future  researeh  studies  to  use. 

B,  BACKGROUND  OF  THE  787  DREAMLINER  PROGRAM 

The  787  Dreamliner  was  “Boeing’s  next  generation  eommereial  aireraft  targeted 
at  the  aviation  market  segment  of  rapid,  direet  and  point-to-point  eonneetions”  (Zhao 
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2012,  2).  The  787  is  a  mid-sized  aircraft  that  seats  between  250-310  people.  “The 
Dreamliner  is  unique  in  its  extensive  use  of  the  lightweight  composite  materials,  which 
accounted  for  about  50%  of  the  airplane  by  weight,  and  80%  by  volume”  (Teresko  2007; 
Zhao  2012,  2).  Overall,  “the  Boeing  787  Dreamliner  was  designed  to  cost  less  to  operate 
and  maintain  than  the  current  generation  aircrafts”  (Zhao,  2012,  2).  In  order  to  optimize 
the  sales  of  the  787  Dreamliner,  Boeing  decided  to  use  a  global  approach  to  the  design, 
development,  and  manufacturing  of  the  787  Dreamliner  commercial  aircraft.  Boeing  had 
thought  that  if  countries  would  be  more  willing  to  buy  an  aircraft  in  which  that  country 
had  economic  ties.  As  a  result,  the  787  Dreamliner  had  an  unprecedented  scale  of 
development  outsourcing —  65  percent  of  the  development  work  was  outsourced  to  more 
than  100  suppliers  from  12  countries  (Exostar  2007;  Horng  and  Bozdogan  2007).  The 
Tier  1  suppliers  were  responsible  for  design,  fabrication,  integration  and  assembly  of  the 
components  from  the  Tier  2  and  3  suppliers.  Figure  12  shows  a  breakout  of  the  Tier  1 
suppliers. 
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Figure  12.  Tier  1  Suppliers  for  the  Boeing  787  Dreamliner  (from  Zhao  2012) 


In  addition,  Boeing  also  wanted  to  share  the  economic  risk  of  such  a  big 
development  effort  with  other  countries  in  the  event  the  787  Dreamliner  was  a  failure. 
The  concept  was  that  “suppliers  share  more  than  half  of  the  upfront  non-recurring  R&D 
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investment  (Lee  and  Anupindi  2009),  whieh  ean  be  broken  down  as  follows:  Alenia 
($590  million),  Japanese  Heavies  ($1.6  billion).  Global  Aeronautiea  (GA),  Spirit,  Vought 
($3.1  billion),  and  Boeing  ($4.2  billion)”  (Zhao  2012,  5).  On  paper,  this  seemed  like  a 
good  plan.  So,  what  could  go  wrong? 

The  consequence  was  that  the  “first  flight  was  delayed  by  26  months  and  the  first 
delivery  was  delayed  by  40  months  with  a  cost  overrun  of  at  least  $10  billion”  (Zhao 
2012,  1. 

C.  ANALYSIS  OF  THE  CASE  STUDY 

The  major  hurdle  derived  from  multiple  companies  who  were  jointly  dependent 
on  each  other  to  control  cost  and  maintain  schedule.  Boeing  had  to  trust  its  suppliers  to 
meet  the  schedule  deadlines  which  sometimes  meant  trusting  the  other  companies  to  put 
the  787  Dreamliner  project’s  success  over  their  individual  company’s  success.  The 
problem  was  that  Boeing  did  not  have  a  plan  to  manage  this  issue.  As  a  result  there  were 
seven  major  delays  that  were  recorded  to  explain  the  40-month  delay  and  $10  billion  cost 
overrun. 

According  to  the  case  study,  of  the  seven  major  delays,  three  could  be  attributed 
to  technical  issues,  such  as  bad  documentation,  structural  flaw  in  engineering  design,  and 
underestimated  task  duration.  However,  the  other  four  major  delays  can  be  attributed  to 
bad  program  risk  management. 

1.  How  Could  Trust  Have  Helped  the  Boeing  787  Dreamliner  Program 
Risk  Management? 

The  trust  factor  is  valuable  in  that  is  does  not  rely  on  technical  risks  to  highlight 
risk  items.  It  opens  program  managements  thinking  to  linkages/codependences  rather 
than  individual  event.  Below  are  examples  of  how  using  the  three  elements  of  trust 
(confidence,  vulnerability,  and  uncertainty)  could  have  save  the  Boeing  787  Dreamliner 
cost  and  schedule. 
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a.  Confidence 

Boeing  selected  the  company  “Vought  to  design  and  manufacture  the  world’s  first 
all-composite  aft-fuselage”  (Zhao  2012,  8).  However,  at  the  time  when  selected,  Vought 
had  no  engineering  department.  This  apparent  lack  of  an  organizational  recognition  of  an 
engineering  skill  may  not  have  shown  up  on  a  typical  risk  matrix  because  there  is  not  a 
technical  or  quantitative  value  to  place  on  this  item.  However,  if  Boeing  were  to  analyze 
this  item  from  a  trust  perspective,  it  would  have  identified  a  low  confidence  level  in 
selecting  this  company.  If  the  company  were  already  selected,  the  fact  that  Vought  had  no 
engineering  department  would  have  been  identified  as  a  high  risk. 

b.  Vulnerability 

For  example,  Vought  waited  until  nearly  the  last  moment  (May  2006)  to  build  the 
plant  (job  assigned  November  2003,  due  May  2007).  If  Boeing  were  to  analyze  this  item 
from  a  trust  perspective,  it  would  have  realized  that  this  company  was  not  fully  invested 
in  the  success  of  the  overall  787  Dreamliner  project.  Boeing  could  have  seen  that  Vought 
was  putting  its  company  first  and  only  looking  to  do  the  bare  minimum  to  fulfill  its 
contract  obligation. 

c.  Uncertainty 

The  production  of  the  Boeing  787  Dreamliner  adopted  a  new  outsourcing  model. 
Boeing  opted  to  employ  a  tiered  structure  process  that  assigned  the  Tier  1  contractors  as 
lead  integrators,  responsible  for  the  assembly  of  different  parts  and  subsystems  provided 
from  the  Tier  2  and  Tier  3  suppliers.  This  would  not  have  shown  up  on  a  typical  risk 
matrix  because  process  was  new  and  there  were  no  quantitative  technical  measures  that 
would  highlight  this  integration  process  as  a  risk.  However,  if  Boeing  would  have 
analyzed  this  from  a  trust  perspective,  Boeing  would  have  identified  that  this  process  was 
different  from  their  previous  process  in  which  Boeing  played  the  traditional  role  of 
integrating  and  assembling  different  parts  and  subsystems.  This  identification  of  the  risk 
earlier  may  have  encouraged  Boeing  to  take  a  bigger  role  in  the  integration  of  the  787 
Dreamliner  program  and  prevented  some  of  the  schedule  and  cost  over  runs. 
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This  chapter  defined  case  study  and  the  proeess  to  validate  a  ease  study  for  the 
purposed  of  using  a  ease  study  as  a  research  method.  The  Boeing  787  case  study  was 
validated  and  reinforeed  the  argument  that  the  incorporation  of  trust  can  be  a  valuable 
tool  in  assessing  risk  without  the  need  for  metrics  and  quantitative  values.  The  following 
chapter  will  summarize  this  research  paper  with  conclusion  and  recommendations 
supported  by  the  previous  ehapters.  In  addition,  several  topics  for  future  researeh  studies 
will  be  described. 
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VI.  CONCLUSIONS  RECOMMENDATIONS,  AND 
AREAS  OF  FURTHER  STUDY 


A,  CONCLUSION 

The  purpose  of  this  paper  was  to  determine  whether  it  was  feasible  and 
advantageous  to  ineorporate  “trust”  into  the  risk  management  proeess  for  DOD 
aequisition.  The  premise  was  that  there  were  hidden  risk  faetors  attributed  to  qualitative 
measures  that  were  not  being  identified  in  the  eurrent  risk  management  proeess.  These 
qualitative  measures  of  risk  eould  be  direetly  linked  to  trust  elements.  This  researeh  paper 
presented  a  sound  argument  on  why  trust  should  be  ineorporated  into  the  risk 
management  proeess  for  DOD  aequisition  programs.  Various  soeial,  behavioral, 
theologieal,  and  technieal  expert  definitions  on  the  term  trust  were  used  to  deeompose 
trust  into  three  key  elements:  eonfidenee,  vulnerability,  and  uneertainty.  The  three  trust 
elements:  eonfidenee,  vulnerability  and  uneertainty,  were  further  defined  and  eorrelated 
with  eurrent  industry  program  risk  management  practiees.  Based  on  the  analysis  of  the 
three  trust  elements,  trust  was  define  for  the  purpose  and  use  in  risk  management.  Trust 
for  risk  management  was  defined  as  the  subjeetive  probability  of  a  positive  outeome  from 
an  agreement  between  two  or  more  parties  for  a  domain  speeifie  task  based  on  the 
eapability  and  goodwill  of  the  trustee  and  predietability  of  a  positive  outeome  within  the 
defined  technieal,  cost  and  schedule  boundaries. 

Industry  is  starting  to  adopt  qualitative  risk  management.  Modernization  of 
communication  paths  (i.e.,  e-mail  and  video  teleconferencing),  and  quick  technology 
advancement  have  opened  industry  to  new  partners  in  a  global  economy.  In  addition, 
there  has  also  been  an  influx  of  business  corruption  that  has  left  people  and  companies 
skittish  about  openly  trusting  their  partners.  New  business  partners  lead  to  possible 
confidence,  vulnerability,  and  uncertainty  concerns.  Companies  have  to  weigh  these  trust 
elements  when  entering  new  partnerships  and  throughout  the  contract.  To  accentuate  the 
point  of  global  business  partnership  trust  based  risks,  this  research  paper  analyzed  a  case 
study  on  the  Boeing  777  Dreamliner  program  which  had  an  unprecedented  scale  of 
development  outsourcing —  65  percent  of  the  development  work  was  outsourced  to  more 
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than  100  suppliers  from  12  countries  (Exostar  2007;  Homg  and  Bozdogan  2007).  A 
validation  of  the  case  study  was  conducted  against  Robert  Yin’s  research  on  case  study 
design  and  methods  (Yin  2009)  and  Gary  Langford’s  research  on  engineering  methods 
(Langford  2012).  The  case  study  was  concluded  as  valid  and  appropriate  for  analysis  for 
the  topic  of  this  research  on  trust  in  risk  management.  The  analysis  of  the  case  study 
determined  there  was  risk  items  associated  with  each  trust  element  (confidence, 
vulnerability,  and  uncertainty)  that  could  have  been  identified  earlier  if  trust  had  been 
incorporated  into  Boeing’s  risk  management  process. 

Research  was  also  conducted  on  the  feasibility  of  incorporating  the  trust  elements 
of  risk  into  the  risk  management  process  for  DOD  acquisition.  The  relationship  between 
trust  and  risk  was  defined  from  social  science  research  and  scientific  methods.  By 
examining  social  science  research,  it  was  determined  that  to  capture  the  likelihood  and 
consequence  of  an  action  that  requires  dependence  on  other  individuals  to  take  action,  the 
element  of  trust  should  be  assessed.  Through  logic  and  psychometrics  studies  of  risk  and 
trust,  it  was  determined  that  risk  and  trust  were  inversely  related.  The  Dempster-Shafer 
theory  was  used  to  prove  that  trust  elements  could  be  added  long  as  there  is  no  major 
conflict  between  the  sources.  The  principle  of  indifference  (Keynes  1921)  supported  the 
theory  that  each  element  should  be  weighed  equally  since  we  have  no  idea  which  element 
is  more  plausible.  Alexander  McNeil’s  (2005)  research  on  the  axiom  of  coherence  was 
applied  to  conclude  that  risk  and  trust  elements  were  additive.  However,  the  process  is 
not  simple  mathematical  addition,  since  trust  and  risk  are  inversely  related.  Gary 
Langford’s  (2007)  method  for  managing  complexity  warranted  the  use  of  geometric 
relationships  to  combine  risk  and  trust  into  a  matrix  report. 

The  current  Risk  Management  Guide  for  DOD  Acquisition  (DOD  2006)  was 
studied  and  the  process  was  decomposed  to  determine  how  and  where  the  qualitative 
measures  (trust  factors)  of  risk  could  be  addressed.  The  most  practical  place  for  the  trust 
elements  of  risk  to  be  analyzed  was  during  the  analysis  of  the  quantitative  measurement 
of  risk.  A  detailed  step  by  step  example  of  how  to  take  a  risk  item  through  the  proposed 
risk  and  trust  management  process  for  DOD  acquisition  was  described.  Qualitative 
assessment  measurement  definitions  for  all  three  trust  elements;  confidence, 
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vulnerability,  and  uncertainty  were  created.  Example  questions  were  also  provided  to 
assist  in  identifying  trust  risks.  The  risk  management  example  highlighted  how  a  risk 
item  that  was  assessed  quantitatively  as  a  low  risk  was  raised  to  a  medium  risk  when 
qualitative  measurements  (trust)  were  included  in  the  evaluation. 

In  conclusion,  this  research  paper  posits  that  the  incorporation  of  trust  into  the  risk 
management  process  for  DOD  acquisition  is  feasible  and  advantageous.  The  proposed 
risk  and  trust  management  process  will  provide  the  program  manager  more  insight  into 
the  root  cause  of  the  risk.  Clearer  insight  into  the  root  cause  will  aid  in  management  of 
risk  and  resource  allocation  for  mitigating  risk. 

B,  RECOMMENDATIONS 

Based  on  the  research  and  case  study  analysis  it  is  recommend  that  trust  be 
incorporated  into  the  risk  management  process  for  DOD  acquisition.  The  process  as 
outlined  in  Chapter  IV  should  be  added  to  the  Risk  Management  Guide  for  DOD 
Acquisition.  This  process  will  only  enhance  a  program  manager’s  ability  to  understand 
the  root  cause  of  a  risk  item  and  properly  mitigate  the  risk. 

C.  AREAS  OF  FURTHER  STUDY 

There  is  a  vast  amount  of  data  and  research  that  has  been  completed  on  the  topic 
of  trust.  Due  to  time  constraints  and  the  abundance  of  information,  all  the  topics  related 
to  this  research  could  not  be  explored.  Identified  topics  related  to  trust  that  may  be 
worthy  of  future  studies  or  analysis  are  provided  below. 

1.  The  Risk  of  Firm  Fixed  Price  vs.  Cost  Plus  Incentive  Fee  Contracts 

There  is  an  element  of  trust  and  risk  involved  in  the  decision  of  going  with  a  Firm 
Fixed  Price  or  Cost  Plus  Incentive  Fee  DOD  acquisition  contract.  Generally,  for  a  cost 
plus  incentive  fee  DOD  acquisition  contract,  the  government  assumes  risk  because  the 
contractor  can  get  more  money  if  the  program  falls  behind  schedule  or  runs  over  cost. 
However,  for  a  firm  fixed  price  DOD  contract,  the  contractor  assumes  most  of  the  risk 
because  there  is  no  money  to  be  gained  if  a  program  falls  behind  schedule  or  runs  over 
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budget.  However,  a  eontraetor  may  deeide  to  terminate  the  eontraet  if  the  eompany  loses 
too  mueh  money  on  the  program.  In  both  oases,  the  government  must  trust  the  eontraetor. 

2.  Analysis  Qualitative  +  Quantitative  Risk  Management  Results  in  the 
Commercial  Business  World 

It  would  be  valuable  to  researoh  oompanies  that  have  inoluded  both  qualitative 
and  quantitative  risk  management  praotioes  into  their  business  deoision  making  prooess  to 
determine  whether  it  had  a  positive  outoome.  Asian  oompanies  appear  to  have  the  most 
experienoe  with  qualitative  risk  assessment.  It  would  also  be  valuable  to  highlight  some 
lessons  learned  using  trust  and  risk  faotor  based  deoision  making. 

3.  Analysis  of  Whether  a  Program  That  Places  More  Emphasis  on  Trust 
than  Risk  is  More  Efficient 

Most  experts  olaim  that  a  high  level  of  trust  allows  for  good  oommunioation  and 
faster  deoision  making.  But  blind  trust  oan  be  equally  damaging  if  unoheoked.  It  would  be 
interesting  to  determine  if  there  is  an  optimum  level  of  trust  that  will  allow  a  program  to 
be  more  effioient  and  how  that  level  oan  be  aohieved. 
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APPENDIX.  BOEING  787  DREAMLINER  CASE  STUDY 


The  2012  Boeing  787  Dreamliner  ease  study,  by  Yao  Zhao,  PhD,  Assoeiate 
Professor  in  Supply  Chain  and  Projeet  Management  Rutgers,  the  State  University  of  New 
Jersey,  may  be  read  in  its  entirety  on  the  web  using  the  following  link: 

http://zhao.rutgers.edu/787-paper-12-02-2013.pdf 
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